From 9f13bca6b86c2619e78251c1dcd9ac9a026a6422 Mon Sep 17 00:00:00 2001
From: Kenneth Loeffler <kenloef@gmail.com>
Date: Wed, 25 Oct 2023 14:21:58 -0700
Subject: [PATCH]  rbx_dom_lua rojo-rbx/rbx-dom@440f3723 (attribute validation)
  (#809)

Brings over some changes to rbx_dom_lua to validate attribute names
before calling `Instance:SetAttribute`. This should prevent Rojo from
falling over when it attempts to sync an attribute with an invalid name.
---
 CHANGELOG.md                            |  2 ++
 plugin/rbx_dom_lua/customProperties.lua | 21 ++++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d20454f24..e14c9fcf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,11 +7,13 @@
  	This ensures that the script editor reflects any changes Rojo makes to a script while it is open in the script editor.
 
 * Fixed issues when handling `SecurityCapabilities` values ([#803], [#807])
+* Fixed Rojo plugin erroring out when attempting to sync attributes with invalid names ([#809])
 
 [#800]: https://github.com/rojo-rbx/rojo/pull/800
 [#801]: https://github.com/rojo-rbx/rojo/pull/801
 [#803]: https://github.com/rojo-rbx/rojo/pull/803
 [#807]: https://github.com/rojo-rbx/rojo/pull/807
+[#809]: https://github.com/rojo-rbx/rojo/pull/809
 
 ## [7.4.0-rc2] - October 3, 2023
 * Fixed bug with parsing version for plugin validation ([#797])
diff --git a/plugin/rbx_dom_lua/customProperties.lua b/plugin/rbx_dom_lua/customProperties.lua
index 3ffbf7af5..072db9ef0 100644
--- a/plugin/rbx_dom_lua/customProperties.lua
+++ b/plugin/rbx_dom_lua/customProperties.lua
@@ -37,9 +37,24 @@ return {
 			end,
 			write = function(instance, _, value)
 				local existing = instance:GetAttributes()
+				local didAllWritesSucceed = true
 
-				for key, attr in pairs(value) do
-					instance:SetAttribute(key, attr)
+				for attributeName, attributeValue in pairs(value) do
+					local isNameValid =
+						-- For our SetAttribute to succeed, the attribute name must be
+						-- less than or equal to 100 characters...
+						#attributeName <= 100
+						-- ...must only contain alphanumeric characters, periods, hyphens,
+						-- underscores, or forward slashes...
+						and attributeName:match("[^%w%.%-_/]") == nil
+						-- ... and must not use the RBX prefix, which is reserved by Roblox.
+						and attributeName:sub(1, 3) ~= "RBX"
+
+					if isNameValid then
+						instance:SetAttribute(attributeName, attributeValue)
+					else
+						didAllWritesSucceed = false
+					end
 				end
 
 				for key in pairs(existing) do
@@ -48,7 +63,7 @@ return {
 					end
 				end
 
-				return true
+				return didAllWritesSucceed
 			end,
 		},
 		Tags = {