Editor crashes if the attribute name is a number

[Mgsy]

📝 Provide detailed reproduction steps (if any)

1. Go to https://ckeditor.com/docs/ckeditor5/37.0.1/features/html/general-html-support.html.
2. Execute editor.setData('<p><foo 200="test">test</foo></p>').

❌ Actual result

The editor crashes.

snippet.js:4 Uncaught Error: Failed to execute 'setAttribute' on 'Element': '200' is not a valid attribute name.
    at na.setDomElementAttribute (snippet.js:4:121865)
    at na.viewToDom (snippet.js:4:121421)
    at na.viewChildrenToDom (snippet.js:4:122402)
    at viewChildrenToDom.next (<anonymous>)
    at na.viewToDom (snippet.js:4:121502)
    at Pc.toData (snippet.js:4:234200)
    at model (snippet.js:4:568008)
    at snippet.js:4:214567
    at Tc.<anonymous> (snippet.js:4:214600)
    at Tc.fire (snippet.js:4:5713)

📃 Other details

• It crashes also after pasting the content.

---

If you'd like to see this fixed sooner, add a 👍 reaction to this post.

[arkflpc]

Actually, it can fail whenever the attribute name starts with non-letter. In example (in Firefox and Chrome):

// Both fail:
element.setAttribute('2x', 'abc')
element.setAttribute('-x', 'abc')

// Both seem to be accepted by browsers:
element.setAttribute('x2', 'abc')
element.setAttribute('x-', 'abc')

[niegowski]

We should filter out invalid DOM attributes. We are doing it already but for custom elements, we have a custom support that lacks the filtering:

ckeditor5/packages/ckeditor5-html-support/src/integrations/customelement.ts

Line 101 in 1c48986

const htmlContent = editor.data.processor.toData( documentFragment );

as while we process attributes, we skip invalid ones:

ckeditor5/packages/ckeditor5-html-support/src/datafilter.ts

Lines 627 to 629 in 1c48986

	if ( !isValidAttributeName( key as string ) ) {
	attributes.delete( key );
	}