From 261d9ffe4b0a07f8c4c66ad12367b718efdec387 Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Mon, 14 Sep 2026 12:43:44 -0700
Subject: [PATCH 1/4] fix(trace-viewer): reject unsafe snapshot tag names

Crafted traces could put markup in the element name so the renderer
emitted attributes such as onerror. Drop names that are not a single
HTML token.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 packages/isomorphic/trace/snapshotRenderer.ts |  2 ++
 tests/library/snapshot-renderer.spec.ts       | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/packages/isomorphic/trace/snapshotRenderer.ts b/packages/isomorphic/trace/snapshotRenderer.ts
index 2a38aca7b651e..15c742bdb8b21 100644
--- a/packages/isomorphic/trace/snapshotRenderer.ts
+++ b/packages/isomorphic/trace/snapshotRenderer.ts
@@ -108,6 +108,8 @@ export class SnapshotRenderer {
         // crafted trace file could include them to achieve XSS.
         if (name.toUpperCase() === 'SCRIPT')
           return;
+        if (!/^[A-Za-z][A-Za-z0-9:-]*$/.test(name))
+          return;
         // Element node.
         // Note that <noscript> will not be rendered by default in the trace viewer, because
         // JS is enabled. So rename it to <x-noscript>.
diff --git a/tests/library/snapshot-renderer.spec.ts b/tests/library/snapshot-renderer.spec.ts
index 9dce93b7d463a..d4276b8fd219a 100644
--- a/tests/library/snapshot-renderer.spec.ts
+++ b/tests/library/snapshot-renderer.spec.ts
@@ -126,6 +126,24 @@ test('snapshot renderer handles case-insensitive iframe tag names', () => {
   expect(html).toContain('__playwright_src__');
 });
 
+test('snapshot renderer drops unsafe tag names that smuggle attributes', () => {
+  const renderer = new SnapshotRenderer(new LRUCache(1_000_000), [], [makeSnapshot({
+    html: ['HTML', {}, ['BODY', {}, ['img src=x onerror=alert(1)', {}], 'safe']],
+  })], [], 0);
+  const { html } = renderer.render();
+  expect(html).not.toContain('onerror=alert(1)');
+  expect(html).not.toContain('<img src=x');
+  expect(html).toContain('safe');
+});
+
+test('snapshot renderer still renders ordinary custom elements', () => {
+  const renderer = new SnapshotRenderer(new LRUCache(1_000_000), [], [makeSnapshot({
+    html: ['HTML', {}, ['BODY', {}, ['MY-WIDGET', { 'id': 'w' }, 'hello']]],
+  })], [], 0);
+  const { html } = renderer.render();
+  expect(html).toContain('<MY-WIDGET id="w">hello</MY-WIDGET>');
+});
+
 test('stripAnsiEscapes should not exhibit polynomial backtracking', () => {
   // \x1b[ + 50000 semicolons + non-terminal character.
   // Before the fix this took >3 seconds due to O(n^2) backtracking.

From 6b0816ad390fbe65ae90a435c1be49a380795a60 Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Mon, 14 Sep 2026 13:35:24 -0700
Subject: [PATCH 2/4] fix(trace-viewer): keep custom elements with _ and .

Allow WHATWG-valid names such as my-widget_v2 in snapshot HTML.
Attribute-smuggling payloads still fail the tag-name check.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 packages/isomorphic/trace/snapshotRenderer.ts | 2 +-
 tests/library/snapshot-renderer.spec.ts       | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/isomorphic/trace/snapshotRenderer.ts b/packages/isomorphic/trace/snapshotRenderer.ts
index 15c742bdb8b21..818d96e9c1e3e 100644
--- a/packages/isomorphic/trace/snapshotRenderer.ts
+++ b/packages/isomorphic/trace/snapshotRenderer.ts
@@ -108,7 +108,7 @@ export class SnapshotRenderer {
         // crafted trace file could include them to achieve XSS.
         if (name.toUpperCase() === 'SCRIPT')
           return;
-        if (!/^[A-Za-z][A-Za-z0-9:-]*$/.test(name))
+        if (!/^[A-Za-z][A-Za-z0-9:._-]*$/.test(name))
           return;
         // Element node.
         // Note that <noscript> will not be rendered by default in the trace viewer, because
diff --git a/tests/library/snapshot-renderer.spec.ts b/tests/library/snapshot-renderer.spec.ts
index d4276b8fd219a..72e4f4fc378fa 100644
--- a/tests/library/snapshot-renderer.spec.ts
+++ b/tests/library/snapshot-renderer.spec.ts
@@ -138,10 +138,16 @@ test('snapshot renderer drops unsafe tag names that smuggle attributes', () => {
 
 test('snapshot renderer still renders ordinary custom elements', () => {
   const renderer = new SnapshotRenderer(new LRUCache(1_000_000), [], [makeSnapshot({
-    html: ['HTML', {}, ['BODY', {}, ['MY-WIDGET', { 'id': 'w' }, 'hello']]],
+    html: ['HTML', {}, ['BODY', {},
+      ['MY-WIDGET', { 'id': 'w' }, 'hello'],
+      ['MY-WIDGET_V2', { 'id': 'w2' }, 'v2'],
+      ['MY-WIDGET.V2', { 'id': 'w3' }, 'dot'],
+    ]],
   })], [], 0);
   const { html } = renderer.render();
   expect(html).toContain('<MY-WIDGET id="w">hello</MY-WIDGET>');
+  expect(html).toContain('<MY-WIDGET_V2 id="w2">v2</MY-WIDGET_V2>');
+  expect(html).toContain('<MY-WIDGET.V2 id="w3">dot</MY-WIDGET.V2>');
 });
 
 test('stripAnsiEscapes should not exhibit polynomial backtracking', () => {

From fbeb2498dee574c2874cbe9bbe4b65689f5ff21a Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Tue, 15 Sep 2026 16:54:39 -0700
Subject: [PATCH 3/4] fix(trace-viewer): allow Unicode custom element names

Reject only names that smuggle attributes (whitespace, =, <, >, /).

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 packages/isomorphic/trace/snapshotRenderer.ts | 4 +++-
 tests/library/snapshot-renderer.spec.ts       | 4 ++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/isomorphic/trace/snapshotRenderer.ts b/packages/isomorphic/trace/snapshotRenderer.ts
index 818d96e9c1e3e..ff5432b3b5569 100644
--- a/packages/isomorphic/trace/snapshotRenderer.ts
+++ b/packages/isomorphic/trace/snapshotRenderer.ts
@@ -108,7 +108,9 @@ export class SnapshotRenderer {
         // crafted trace file could include them to achieve XSS.
         if (name.toUpperCase() === 'SCRIPT')
           return;
-        if (!/^[A-Za-z][A-Za-z0-9:._-]*$/.test(name))
+        // Reject names that would emit extra attributes (space, =, <, >, /).
+        // Allow Unicode custom elements such as math-α.
+        if (!name || /[\s=<>\/]/.test(name))
           return;
         // Element node.
         // Note that <noscript> will not be rendered by default in the trace viewer, because
diff --git a/tests/library/snapshot-renderer.spec.ts b/tests/library/snapshot-renderer.spec.ts
index 72e4f4fc378fa..2bfa23ecab7aa 100644
--- a/tests/library/snapshot-renderer.spec.ts
+++ b/tests/library/snapshot-renderer.spec.ts
@@ -142,12 +142,16 @@ test('snapshot renderer still renders ordinary custom elements', () => {
       ['MY-WIDGET', { 'id': 'w' }, 'hello'],
       ['MY-WIDGET_V2', { 'id': 'w2' }, 'v2'],
       ['MY-WIDGET.V2', { 'id': 'w3' }, 'dot'],
+      ['math-α', { 'id': 'm' }, 'alpha'],
+      ['my-élément', { 'id': 'e' }, 'elem'],
     ]],
   })], [], 0);
   const { html } = renderer.render();
   expect(html).toContain('<MY-WIDGET id="w">hello</MY-WIDGET>');
   expect(html).toContain('<MY-WIDGET_V2 id="w2">v2</MY-WIDGET_V2>');
   expect(html).toContain('<MY-WIDGET.V2 id="w3">dot</MY-WIDGET.V2>');
+  expect(html).toContain('<math-α id="m">alpha</math-α>');
+  expect(html).toContain('<my-élément id="e">elem</my-élément>');
 });
 
 test('stripAnsiEscapes should not exhibit polynomial backtracking', () => {

From 169e8e4eb5ffa48569726ea505beee28e7a57fb5 Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Thu, 17 Sep 2026 12:23:42 -0700
Subject: [PATCH 4/4] fix(trace-viewer): drop empty-name snapshot check

Capture never produces an empty nodeName. Keep the smuggle regex.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 packages/isomorphic/trace/snapshotRenderer.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/isomorphic/trace/snapshotRenderer.ts b/packages/isomorphic/trace/snapshotRenderer.ts
index ff5432b3b5569..63612c79ae3ad 100644
--- a/packages/isomorphic/trace/snapshotRenderer.ts
+++ b/packages/isomorphic/trace/snapshotRenderer.ts
@@ -110,7 +110,7 @@ export class SnapshotRenderer {
           return;
         // Reject names that would emit extra attributes (space, =, <, >, /).
         // Allow Unicode custom elements such as math-α.
-        if (!name || /[\s=<>\/]/.test(name))
+        if (/[\s=<>\/]/.test(name))
           return;
         // Element node.
         // Note that <noscript> will not be rendered by default in the trace viewer, because