Repository: angular/angular
File: packages/core/src/sanitization/sanitization.ts (TypeScript)

Code before:
  const lView = getLView();
  return lView && lView[ENVIRONMENT].sanitizer;
}

const attributeName: ReadonlyArray<string> = ['attributename'];

/**
 * @remarks Keep this in sync with DOM Security Schema.
 * @see [SECURITY_SCHEMA](../../../compiler/src/schema/dom_security_schema.ts)
 */
const SECURITY_SENSITIVE_ELEMENTS: Readonly<Record<string, ReadonlyArray<string>>> = {
  'iframe': ['sandbox', 'allow', 'allowfullscreen', 'referrerpolicy', 'csp', 'fetchpriority'],
  'animate': attributeName,
  'set': attributeName,
  'animatemotion': attributeName,
  'animatetransform': attributeName,
};

/**
 * Validates that the attribute binding is safe to use.
 *
 * @param value The value of the attribute.
 * @param tagName The name of the tag.
 * @param attributeName The name of the attribute.
 */
export function ɵɵValidateAttribute(value: any, tagName: string, attributeName: string) {
  const lowerCaseTagName = tagName.toLowerCase();
  const lowerCaseAttrName = attributeName.toLowerCase();
  if (!SECURITY_SENSITIVE_ELEMENTS[lowerCaseTagName]?.includes(lowerCaseAttrName)) {
    return value;
  }

  // Restrict any dynamic bindings of security-sensitive attributes/properties
  // on an <iframe> for security reasons.
  if (lowerCaseTagName === 'iframe') {
    return validateIframeAttribute(value, tagName, attributeName);
  }

  const errorMessage =
    ngDevMode &&
    `Binding to attribute '${attributeName}' of '${tagName}' is disallowed for security reasons, ` +
      `please use ${attributeName}="..."`;

  throw new RuntimeError(RuntimeErrorCode.UNSAFE_ATTRIBUTE_BINDING, errorMessage);
}


Review comment (suggestion):
Lowercasing instruction name for consistency:
```suggestion
export function ɵɵvalidateAttribute(value: any, tagName: string, attributeName: string) {
```

Code after:
  }
}

function getSanitizer(): Sanitizer | null {
  const lView = getLView();
  return lView && lView[ENVIRONMENT].sanitizer;
}

const attributeName: ReadonlySet<string> = new Set(['attributename']);

/**
 * @remarks Keep this in sync with DOM Security Schema.
 * @see [SECURITY_SCHEMA](../../../compiler/src/schema/dom_security_schema.ts)
 */
const SECURITY_SENSITIVE_ELEMENTS: Readonly<Record<string, ReadonlySet<string>>> = {
  'iframe': new Set([
    'sandbox',
    'allow',
    'allowfullscreen',
    'referrerpolicy',
    'csp',
    'fetchpriority',
  ]),
  'animate': attributeName,
  'set': attributeName,
  'animatemotion': attributeName,
  'animatetransform': attributeName,
};

/**
 * Validates that the attribute binding is safe to use.
 *
 * @param value The value of the attribute.
 * @param tagName The name of the tag.
 * @param attributeName The name of the attribute.
 */
export function ɵɵvalidateAttribute(
  value: unknown,
  tagName: string,
  attributeName: string,
): unknown {
  const lowerCaseTagName = tagName.toLowerCase();
  const lowerCaseAttrName = attributeName.toLowerCase();
  if (!SECURITY_SENSITIVE_ELEMENTS[lowerCaseTagName]?.has(lowerCaseAttrName)) {
    return value;
  }

  const tNode = getSelectedTNode()!;
  if (tNode.type !== TNodeType.Element) {
    return value;
  }