fix: disallow invalid attributes for <svelte:window> and `<svelte:d…

…ocument>` (#14228)

.changeset/fast-ligers-repeat.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: disallow invalid attributes for `<svelte:window>` and `<svelte:document>`

documentation/docs/98-reference/.generated/compile-errors.md

@@ -412,6 +412,12 @@ Expected whitespace
 `$host()` can only be used inside custom element component instances
 ```
 
+### illegal_element_attribute
+
+```
+`<%name%>` does not support non-event attributes or spread attributes
+```
+
 ### import_svelte_internal_forbidden
 
 ```

packages/svelte/messages/compile-errors/template.md

@@ -172,6 +172,10 @@
 
 > Expected whitespace
 
+## illegal_element_attribute
+
+> `<%name%>` does not support non-event attributes or spread attributes
+
 ## js_parse_error
 
 > %message%

packages/svelte/src/compiler/errors.js

@@ -984,6 +984,16 @@ export function expected_whitespace(node) {
 	e(node, "expected_whitespace", "Expected whitespace");
 }
 
+/**
+ * `<%name%>` does not support non-event attributes or spread attributes
+ * @param {null | number | NodeLike} node
+ * @param {string} name
+ * @returns {never}
+ */
+export function illegal_element_attribute(node, name) {
+	e(node, "illegal_element_attribute", `\`<${name}>\` does not support non-event attributes or spread attributes`);
+}
+
 /**
  * %message%
  * @param {null | number | NodeLike} node

packages/svelte/src/compiler/phases/2-analyze/visitors/SvelteDocument.js

@@ -1,12 +1,24 @@
 /** @import { AST } from '#compiler' */
 /** @import { Context } from '../types' */
 import { disallow_children } from './shared/special-element.js';
+import * as e from '../../../errors.js';
+import { is_event_attribute } from '../../../utils/ast.js';
 
 /**
  * @param {AST.SvelteDocument} node
  * @param {Context} context
  */
 export function SvelteDocument(node, context) {
 	disallow_children(node);
+
+	for (const attribute of node.attributes) {
+		if (
+			attribute.type === 'SpreadAttribute' ||
+			(attribute.type === 'Attribute' && !is_event_attribute(attribute))
+		) {
+			e.illegal_element_attribute(attribute, 'svelte:document');
+		}
+	}
+
 	context.next();
 }

packages/svelte/src/compiler/phases/2-analyze/visitors/SvelteWindow.js

@@ -1,12 +1,24 @@
 /** @import { AST } from '#compiler' */
 /** @import { Context } from '../types' */
 import { disallow_children } from './shared/special-element.js';
+import * as e from '../../../errors.js';
+import { is_event_attribute } from '../../../utils/ast.js';
 
 /**
  * @param {AST.SvelteWindow} node
  * @param {Context} context
  */
 export function SvelteWindow(node, context) {
 	disallow_children(node);
+
+	for (const attribute of node.attributes) {
+		if (
+			attribute.type === 'SpreadAttribute' ||
+			(attribute.type === 'Attribute' && !is_event_attribute(attribute))
+		) {
+			e.illegal_element_attribute(attribute, 'svelte:window');
+		}
+	}
+
 	context.next();
 }

packages/svelte/tests/validator/samples/illegal_spread_element-document/errors.json

@@ -0,0 +1,14 @@
+[
+	{
+		"code": "illegal_element_attribute",
+		"message": "`<svelte:document>` does not support non-event attributes or spread attributes",
+		"start": {
+			"line": 4,
+			"column": 17
+		},
+		"end": {
+			"line": 4,
+			"column": 23
+		}
+	}
+]

packages/svelte/tests/validator/samples/illegal_spread_element-document/input.svelte

@@ -0,0 +1,4 @@
+<script>
+	let a = {};
+</script>
+<svelte:document {...a}></svelte:document>

packages/svelte/tests/validator/samples/illegal_spread_element-window/errors.json

@@ -0,0 +1,14 @@
+[
+	{
+		"code": "illegal_element_attribute",
+		"message": "`<svelte:window>` does not support non-event attributes or spread attributes",
+		"start": {
+			"line": 4,
+			"column": 15
+		},
+		"end": {
+			"line": 4,
+			"column": 21
+		}
+	}
+]

packages/svelte/tests/validator/samples/illegal_spread_element-window/input.svelte

@@ -0,0 +1,4 @@
+<script>
+	let a = {};
+</script>
+<svelte:window {...a}></svelte:window>