From d1b356d6ae79c51dfc09cb441673f4647aa4d7ab Mon Sep 17 00:00:00 2001
From: Phil Turnbull <phil@semgrep.com>
Date: Tue, 7 Nov 2023 12:43:54 -0500
Subject: [PATCH] Ignore attributes in named arguments

---
 .../security/unquoted-attribute-var.html      | 67 ++++++++++++++++++-
 .../security/unquoted-attribute-var.yaml      |  2 +
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/generic/html-templates/security/unquoted-attribute-var.html b/generic/html-templates/security/unquoted-attribute-var.html
index 8214ecc40f..af6f1ab618 100644
--- a/generic/html-templates/security/unquoted-attribute-var.html
+++ b/generic/html-templates/security/unquoted-attribute-var.html
@@ -11,7 +11,7 @@
 <meta property="og:image:type" content="image/jpeg" />
 <meta property="og:image:width" content="600" />
 <meta property="og:image:height" content="600" />
-<!-- ok -->
+<!-- ok: unquoted-attribute-var -->
 <meta property="not-real-only-for-testing" content="{{ safe }}" />
 
 <!-- Google OAuth sign-in -->
@@ -83,3 +83,68 @@ <h3> rule: <a href="https://semgrep.dev/r?q={{check_id}}"> {{check_id}} </a> </h
     </ul>
     <hr/>
 {% endfor %}
+
+<!-- Octane engine used in newer versions of ember.js -->
+
+<TodoList as |item|>
+    <!-- ok: unquoted-attribute-var -->
+    <Todo @item={{item}} />
+</TodoList>
+
+<!-- ok: unquoted-attribute-var -->
+<MyGreeting @params={{array "Hello" "World"}}>
+
+<!-- ok: unquoted-attribute-var -->
+<h1>{{@title}}</h1>
+
+<!-- ok: unquoted-attribute-var -->
+<h1>{{this.title}}</h1>
+
+<!-- ok: unquoted-attribute-var -->
+<h1>{{or @title "Untitled"}}</h1>
+
+<Message::Avatar
+  // ok: unquoted-attribute-var
+  @title="{{@username}}'s avatar"
+  // ok: unquoted-attribute-var
+  @initial={{@avatarInitial}}
+  // ok: unquoted-attribute-var
+  @initial={{substring @username 0 1}}
+  // ok: unquoted-attribute-var
+  @isActive={{@userIsActive}}
+  // ok: unquoted-attribute-var
+  class={{if @isCurrentUser "current-user"}}
+/>
+<section>
+  <Message::Username
+    // ok: unquoted-attribute-var
+    @name={{@username}}
+    // ok: unquoted-attribute-var
+    @localTime={{@userLocalTime}}
+  />
+
+  {{yield}}
+</section>
+
+<button
+type="button"
+// todook: unquoted-attribute-var
+{{on "click" this.onClickShowDropdown}}
+>
+More Actions
+</button>
+<div id="dropdown-destination" />
+
+<MyDropdownComponent
+// ok: unquoted-attribute-var
+@show={{this.showDropdown}}
+/>
+
+<MyComponent
+  // ok: unquoted-attribute-var
+  @people={{array
+    'Tom Dale'
+    'Yehuda Katz'
+    this.myOtherPerson
+  }}
+/>
diff --git a/generic/html-templates/security/unquoted-attribute-var.yaml b/generic/html-templates/security/unquoted-attribute-var.yaml
index b39cb5254c..4a57b54e38 100644
--- a/generic/html-templates/security/unquoted-attribute-var.yaml
+++ b/generic/html-templates/security/unquoted-attribute-var.yaml
@@ -34,6 +34,8 @@ rules:
   - pattern-inside: <$TAG ...>
   - pattern-not-inside: ="..."
   - pattern-not-inside: ='...'
+  - pattern-not-inside: |
+      @$ATTRIBUTE={{ ... }}
   - pattern: '{{ ... }}'
   fix-regex:
     regex: '{{(.*?)}}'