[FIX] compiler: prevent block- attributes and tags

doc/reference/templates.md

@@ -21,6 +21,7 @@
 - [Fragments](#fragments)
 - [Inline templates](#inline-templates)
 - [Rendering svg](#rendering-svg)
+- [Restrictions](#restrictions)
 
 ## Overview
 
@@ -680,3 +681,13 @@ if a template is supposed to be included in a svg namespace or not. Therefore,
 Owl depends on a heuristic: if a tag is either `svg`, `g` or `path`, then it will
 be considered as svg. In practice, this means that each component or each sub
 templates (included with `t-call`) should have one of these tag as root tag.
+
+## Restrictions
+
+Note that Owl templates forbid the use of tag and or attributes starting with
+the `block-` string. This restriction prevents name collision with the internal
+code of Owl.
+
+```xml
+<div><block-1>this will not be accepted by Owl</block-1></div>
+```

src/compiler/parser.ts

@@ -305,6 +305,9 @@ function parseDOMNode(node: Element, ctx: ParsingContext): AST | null {
   if (tagName === "t" && !dynamicTag) {
     return null;
   }
+  if (tagName.startsWith("block-")) {
+    throw new Error(`Invalid tag name: '${tagName}'`);
+  }
   ctx = Object.assign({}, ctx);
   if (tagName === "pre") {
     ctx.inPreTag = true;
@@ -371,6 +374,8 @@ function parseDOMNode(node: Element, ctx: ParsingContext): AST | null {
         ctx = Object.assign({}, ctx);
         ctx.tModelInfo = model;
       }
+    } else if (attr.startsWith("block-")) {
+      throw new Error(`Invalid attribute: '${attr}'`);
     } else if (attr !== "t-name") {
       if (attr.startsWith("t-") && !attr.startsWith("t-att")) {
         throw new Error(`Unknown QWeb directive: '${attr}'`);

tests/compiler/blacklist.test.ts

@@ -0,0 +1,13 @@
+import { renderToString } from "../helpers";
+
+describe("blacklisted tags and attributes", () => {
+  test("template with block-text tag", () => {
+    const template = `<div><block-text-0/>hello</div>`;
+    expect(() => renderToString(template)).toThrow("Invalid tag name: 'block-text-0'");
+  });
+
+  test("template with block-handler tag", () => {
+    const template = `<div block-handler-0="click">hello</div>`;
+    expect(() => renderToString(template)).toThrow("Invalid attribute: 'block-handler-0'");
+  });
+});