From 068b625bef25b330bd9e611648ece3362dba8ab2 Mon Sep 17 00:00:00 2001
From: Raymond Hill <rhill@raymondhill.net>
Date: Tue, 13 Feb 2024 19:41:25 -0500
Subject: [PATCH] In `set-attr`, restrict `on...` attributes to empty string
 only

As per feedback from https://github.com/distinctmondaylilac

Related commit:
https://github.com/gorhill/uBlock/commit/3037ae5f04

Additionally, added logging ability to the scriptlet.
---
 assets/resources/scriptlets.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/assets/resources/scriptlets.js b/assets/resources/scriptlets.js
index 64e223d65..121e9349e 100644
--- a/assets/resources/scriptlets.js
+++ b/assets/resources/scriptlets.js
@@ -3770,6 +3770,7 @@ builtinScriptlets.push({
     world: 'ISOLATED',
     dependencies: [
         'run-at.fn',
+        'safe-self.fn',
     ],
 });
 function setAttr(
@@ -3777,9 +3778,11 @@ function setAttr(
     attr = '',
     value = ''
 ) {
-    if ( typeof selector !== 'string' ) { return; }
     if ( selector === '' ) { return; }
+    if ( attr === '' ) { return; }
 
+    const safe = safeSelf();
+    const logPrefix = safe.makeLogPrefix('set-attr', attr, value);
     const validValues = [ '', 'false', 'true' ];
     let copyFrom = '';
 
@@ -3797,7 +3800,6 @@ function setAttr(
 
     const extractValue = elem => {
         if ( copyFrom !== '' ) {
-            if ( copyFrom.startsWith('on') && copyFrom in elem ) { return; }
             return elem.getAttribute(copyFrom) || '';
         }
         return value;
@@ -3814,9 +3816,10 @@ function setAttr(
         for ( const elem of elems ) {
             const before = elem.getAttribute(attr);
             const after = extractValue(elem);
-            if ( after === undefined ) { continue; }
             if ( after === before ) { continue; }
+            if ( attr.startsWith('on') && attr in elem && after !== '' ) { continue; }
             elem.setAttribute(attr, after);
+            safe.uboLog(logPrefix, `${attr}="${after}"`);
         }
         return true;
     };