Skip to content

fix(utils): update isShadowRoot to use spec-compliant custom element regex#5059

Open
bwyard wants to merge 1 commit intodequelabs:developfrom
bwyard:fix/5030-shadow-root-unicode-regex
Open

fix(utils): update isShadowRoot to use spec-compliant custom element regex#5059
bwyard wants to merge 1 commit intodequelabs:developfrom
bwyard:fix/5030-shadow-root-unicode-regex

Conversation

@bwyard
Copy link
Copy Markdown

@bwyard bwyard commented Apr 5, 2026

The custom element name regex in isShadowRoot only matches ASCII characters. The HTML spec allows a broader set of Unicode characters in Potential Custom Element Names (PCEN), so valid elements like <café-menu> and <math-π> were being rejected as shadow root candidates.

Two changes:

  • Replace the ASCII-only regex with the spec-compliant PCEN character ranges
  • Add an explicit reserved names check (annotation-xml, color-profile, font-face, etc.): these match the pattern but are explicitly excluded by the spec

Tests added for both cases.

Closes #5030

…regex

The previous regex only matched ASCII characters, causing valid custom
elements with Unicode names (e.g. cafe-menu, math-pi) to be incorrectly
rejected as shadow root candidates. The spec allows a broader set of
Unicode characters in Potential Custom Element Names (PCEN).

Also adds an explicit check for reserved names (annotation-xml,
color-profile, font-face, etc.) that match the pattern but are
explicitly excluded by the spec.

Closes issue dequelabs#5030
@bwyard bwyard requested a review from a team as a code owner April 5, 2026 05:40
@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copy link
Copy Markdown
Contributor

@straker straker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pr. A suggestions about the regex.

// Extends the ASCII-only regex to include Unicode characters permitted by the spec.
// https://html.spec.whatwg.org/multipage/custom-elements.html#valid-custom-element-name
const customElementRegex =
/^[a-z](?:[a-z0-9._-]|[\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD])*-(?:[a-z0-9._-]|[\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD])*$/;
Copy link
Copy Markdown
Contributor

@straker straker Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the custom element name spec, the name must be a valid element local name, which the spec gives a regex as /^(?:[A-Za-z][^\0\t\n\f\r\u0020/>]*|[:_\u0080-\u{10FFFF}][A-Za-z0-9-.:_\u0080-\u{10FFFF}]*)$/u. I assume we could use that with a modification to match the custom element spec of requiring an alpha lower for the 0th char, no alpha upper chars, and a hyphen. Wouldn't this regex work? /^[a-z][a-z0-9-.:_\u0080-\u{10FFFF}]*-[a-z0-9-.:_\u0080-\u{10FFFF}]*$/u

Tested that customElements.define('c-') is a valid custom element name which means we don't need anything after the hyphen either.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd also add a link to the valid element local name spec as well

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks yeah I'll take a look a little later this evening and read through your suggestions and update the pr to match accordingly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Regex for allowed shadow hosts is inaccurate

3 participants