From 11e49c17bc903ba42d07bfd5d4abab41c28a9ae8 Mon Sep 17 00:00:00 2001
From: egamma <egamma@microsoft.com>
Date: Mon, 29 Jun 2026 18:06:24 +0200
Subject: [PATCH 1/2] fix #79631: [html] don't validate custom event handlers
 as JavaScript

---
 .../server/src/modes/embeddedSupport.ts       | 105 +++++++++++++++++-
 .../server/src/test/embedded.test.ts          |   2 +
 2 files changed, 103 insertions(+), 4 deletions(-)

diff --git a/extensions/html-language-features/server/src/modes/embeddedSupport.ts b/extensions/html-language-features/server/src/modes/embeddedSupport.ts
index 247014b9f1c645..4af52f011cc21d 100644
--- a/extensions/html-language-features/server/src/modes/embeddedSupport.ts
+++ b/extensions/html-language-features/server/src/modes/embeddedSupport.ts
@@ -22,6 +22,104 @@ export const CSS_STYLE_RULE = '__';
 
 interface EmbeddedRegion { languageId: string | undefined; start: number; end: number; attributeValue?: boolean }
 
+const eventHandlerAttributes = new Set([
+	'onabort',
+	'onanimationcancel',
+	'onanimationend',
+	'onanimationiteration',
+	'onanimationstart',
+	'onauxclick',
+	'onbeforeinput',
+	'onbeforematch',
+	'onbeforetoggle',
+	'onblur',
+	'oncancel',
+	'oncanplay',
+	'oncanplaythrough',
+	'onchange',
+	'onclick',
+	'onclose',
+	'oncontextlost',
+	'oncontextmenu',
+	'oncontextrestored',
+	'oncopy',
+	'oncuechange',
+	'oncut',
+	'ondblclick',
+	'ondrag',
+	'ondragend',
+	'ondragenter',
+	'ondragleave',
+	'ondragover',
+	'ondragstart',
+	'ondrop',
+	'ondurationchange',
+	'onemptied',
+	'onended',
+	'onerror',
+	'onfocus',
+	'onformdata',
+	'ongotpointercapture',
+	'oninput',
+	'oninvalid',
+	'onkeydown',
+	'onkeypress',
+	'onkeyup',
+	'onlanguagechange',
+	'onload',
+	'onloadeddata',
+	'onloadedmetadata',
+	'onloadstart',
+	'onlostpointercapture',
+	'onmousedown',
+	'onmouseenter',
+	'onmouseleave',
+	'onmousemove',
+	'onmouseout',
+	'onmouseover',
+	'onmouseup',
+	'onpaste',
+	'onpause',
+	'onplay',
+	'onplaying',
+	'onpointercancel',
+	'onpointerdown',
+	'onpointerenter',
+	'onpointerleave',
+	'onpointermove',
+	'onpointerout',
+	'onpointerover',
+	'onpointerrawupdate',
+	'onpointerup',
+	'onprogress',
+	'onratechange',
+	'onreset',
+	'onresize',
+	'onscroll',
+	'onscrollend',
+	'onsecuritypolicyviolation',
+	'onseeked',
+	'onseeking',
+	'onselect',
+	'onslotchange',
+	'onstalled',
+	'onsubmit',
+	'onsuspend',
+	'ontimeupdate',
+	'ontoggle',
+	'ontouchcancel',
+	'ontouchend',
+	'ontouchmove',
+	'ontouchstart',
+	'ontransitioncancel',
+	'ontransitionend',
+	'ontransitionrun',
+	'ontransitionstart',
+	'onvolumechange',
+	'onwaiting',
+	'onwheel'
+]);
+
 
 export function getDocumentRegions(languageService: LanguageService, document: TextDocument): HTMLDocumentRegions {
 	const regions: EmbeddedRegion[] = [];
@@ -243,9 +341,8 @@ function append(result: string, str: string, n: number): string {
 }
 
 function getAttributeLanguage(attributeName: string): string | null {
-	const match = attributeName.match(/^(style)$|^(on\w+)$/i);
-	if (!match) {
-		return null;
+	if (attributeName.toLowerCase() === 'style') {
+		return 'css';
 	}
-	return match[1] ? 'css' : 'javascript';
+	return eventHandlerAttributes.has(attributeName.toLowerCase()) ? 'javascript' : null;
 }
diff --git a/extensions/html-language-features/server/src/test/embedded.test.ts b/extensions/html-language-features/server/src/test/embedded.test.ts
index 1452d02b7c4900..38e32edcc5c62b 100644
--- a/extensions/html-language-features/server/src/test/embedded.test.ts
+++ b/extensions/html-language-features/server/src/test/embedded.test.ts
@@ -114,6 +114,8 @@ suite('HTML Embedded Support', () => {
 
 		assertLanguageId('<label data-content="|Checkbox"/>', 'html');
 		assertLanguageId('<label on="|Checkbox"/>', 'html');
+		assertLanguageId('<div onInvalidAttribute="|test test"></div>', 'html');
+		assertLanguageId('<div onclick="|test test"></div>', 'javascript');
 	});
 
 	test('Script content', function (): any {

From cfdf41a4b9cbd74c457ad2799f8eac0981a146f6 Mon Sep 17 00:00:00 2001
From: egamma <egamma@microsoft.com>
Date: Mon, 29 Jun 2026 18:27:56 +0200
Subject: [PATCH 2/2] =?UTF-8?q?address=20codex=20review=20(round=201)=20?=
 =?UTF-8?q?=E2=80=94=20#79631?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../server/src/modes/embeddedSupport.ts               | 11 +++++++++++
 .../server/src/test/embedded.test.ts                  |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/extensions/html-language-features/server/src/modes/embeddedSupport.ts b/extensions/html-language-features/server/src/modes/embeddedSupport.ts
index 4af52f011cc21d..7c8c183670dc7f 100644
--- a/extensions/html-language-features/server/src/modes/embeddedSupport.ts
+++ b/extensions/html-language-features/server/src/modes/embeddedSupport.ts
@@ -24,6 +24,7 @@ interface EmbeddedRegion { languageId: string | undefined; start: number; end: n
 
 const eventHandlerAttributes = new Set([
 	'onabort',
+	'onafterprint',
 	'onanimationcancel',
 	'onanimationend',
 	'onanimationiteration',
@@ -32,6 +33,7 @@ const eventHandlerAttributes = new Set([
 	'onbeforeinput',
 	'onbeforematch',
 	'onbeforetoggle',
+	'onbeforeunload',
 	'onblur',
 	'oncancel',
 	'oncanplay',
@@ -60,6 +62,7 @@ const eventHandlerAttributes = new Set([
 	'onfocus',
 	'onformdata',
 	'ongotpointercapture',
+	'onhashchange',
 	'oninput',
 	'oninvalid',
 	'onkeydown',
@@ -71,6 +74,7 @@ const eventHandlerAttributes = new Set([
 	'onloadedmetadata',
 	'onloadstart',
 	'onlostpointercapture',
+	'onmessage',
 	'onmousedown',
 	'onmouseenter',
 	'onmouseleave',
@@ -78,6 +82,10 @@ const eventHandlerAttributes = new Set([
 	'onmouseout',
 	'onmouseover',
 	'onmouseup',
+	'onoffline',
+	'ononline',
+	'onpagehide',
+	'onpageshow',
 	'onpaste',
 	'onpause',
 	'onplay',
@@ -91,6 +99,7 @@ const eventHandlerAttributes = new Set([
 	'onpointerover',
 	'onpointerrawupdate',
 	'onpointerup',
+	'onpopstate',
 	'onprogress',
 	'onratechange',
 	'onreset',
@@ -103,6 +112,7 @@ const eventHandlerAttributes = new Set([
 	'onselect',
 	'onslotchange',
 	'onstalled',
+	'onstorage',
 	'onsubmit',
 	'onsuspend',
 	'ontimeupdate',
@@ -115,6 +125,7 @@ const eventHandlerAttributes = new Set([
 	'ontransitionend',
 	'ontransitionrun',
 	'ontransitionstart',
+	'onunload',
 	'onvolumechange',
 	'onwaiting',
 	'onwheel'
diff --git a/extensions/html-language-features/server/src/test/embedded.test.ts b/extensions/html-language-features/server/src/test/embedded.test.ts
index 38e32edcc5c62b..c2d0f08dcb7635 100644
--- a/extensions/html-language-features/server/src/test/embedded.test.ts
+++ b/extensions/html-language-features/server/src/test/embedded.test.ts
@@ -116,6 +116,7 @@ suite('HTML Embedded Support', () => {
 		assertLanguageId('<label on="|Checkbox"/>', 'html');
 		assertLanguageId('<div onInvalidAttribute="|test test"></div>', 'html');
 		assertLanguageId('<div onclick="|test test"></div>', 'javascript');
+		assertLanguageId('<body onbeforeunload="|return false"></body>', 'javascript');
 	});
 
 	test('Script content', function (): any {
@@ -127,6 +128,7 @@ suite('HTML Embedded Support', () => {
 		assertEmbeddedLanguageContent('<script>var data=100; <!--this comment should not give error--> </script>', 'javascript', '        var data=100; /* this comment should not give error */          ');
 		assertEmbeddedLanguageContent('<div onKeyUp="foo()" onkeydown="bar()"/>', 'javascript', '              foo();            bar();  ');
 		assertEmbeddedLanguageContent('<div onKeyUp="return"/>', 'javascript', '              return;  ');
+		assertEmbeddedLanguageContent('<body onbeforeunload="return false"></body>', 'javascript', '                      return false;        ');
 		assertEmbeddedLanguageContent('<div onKeyUp=return\n/><script>foo();</script>', 'javascript', '             return;\n          foo();         ');
 	});