From ea1ec54be1a803731378237786d0e9757625aeef Mon Sep 17 00:00:00 2001
From: Alex Pott <alex.a.pott@googlemail.com>
Date: Tue, 24 Nov 2015 14:22:36 +0000
Subject: [PATCH] Issue #2609928 by micropat, cilefen, Cottser, chx:
 Xss::attributes() mangles valid attribute names containing numbers

---
 core/lib/Drupal/Component/Utility/Xss.php             | 4 ++--
 core/tests/Drupal/Tests/Component/Utility/XssTest.php | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index 423bde43d31..7df0b4d82ca 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -215,7 +215,7 @@ class Xss {
       switch ($mode) {
         case 0:
           // Attribute name, href for instance.
-          if (preg_match('/^([-a-zA-Z]+)/', $attributes, $match)) {
+          if (preg_match('/^([-a-zA-Z][-a-zA-Z0-9]*)/', $attributes, $match)) {
             $attribute_name = strtolower($match[1]);
             $skip = ($attribute_name == 'style' || substr($attribute_name, 0, 2) == 'on');
 
@@ -233,7 +233,7 @@ class Xss {
             ));
 
             $working = $mode = 1;
-            $attributes = preg_replace('/^[-a-zA-Z]+/', '', $attributes);
+            $attributes = preg_replace('/^[-a-zA-Z][-a-zA-Z0-9]*/', '', $attributes);
           }
           break;
 
diff --git a/core/tests/Drupal/Tests/Component/Utility/XssTest.php b/core/tests/Drupal/Tests/Component/Utility/XssTest.php
index a8ab1573210..bdeda3d0eb4 100644
--- a/core/tests/Drupal/Tests/Component/Utility/XssTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/XssTest.php
@@ -516,6 +516,12 @@ class XssTest extends UnitTestCase {
         'Image tag with data attribute',
         array('img')
       ),
+      array(
+        '<a data-a2a-url="foo"></a>',
+        '<a data-a2a-url="foo"></a>',
+        'Link tag with numeric data attribute',
+        array('a')
+      ),
     );
   }