Allow for special attribute filtering.

[smfoote]

Experimental: Allow attribute values to be filtered before being
attached to an element. This should prevent something like:

<a href="{customUrl}">Click me</a>

from being an XSS hole with a context like:

{
  customUrl: "javascript:alert('hacked')"
}

[prashn64]

@jimmyhchan this could be interesting

[jimmyhchan]

we may have to repeat this key a bunch of times. a[href], img[src]. is there a way to gather a bunch of contexts to filter on.

[smfoote]

We could pretty easily define a single function and then assign it to multiple contexts:

function anchorsAndImages (val) {
  ...
}

attrFilters: {
  'a[href]': anchorsAndImages,
  'img[src]': anchorsAndImages
}

I was also thinking of having some more generic rules. For example, 'a' would match all attributes in an anchor tag, and '[src]' would match src attributes on any tag. That leads to a few questions:

1. If multiple filters are found for a single attribute, are they all executed or just the most specific?
2. If they are all executed, in what order are they executed? From most specific to least specific? Random?

[smfoote]

So, even with the new compiler, I think we need to put something in the runtime, because we won't know until runtime if attributes with UGC need to be filtered.