diff --git a/lib/Element.js b/lib/Element.js
index 92c86e2..d480285 100644
--- a/lib/Element.js
+++ b/lib/Element.js
@@ -591,6 +591,11 @@ Element.prototype = Object.create(ContainerNode.prototype, {
// Set the attribute without error checking. The parser uses this.
_setAttribute: { value: function _setAttribute(qname, value) {
+ if (this.namespaceURI === NAMESPACE.SVG) {
+ if (utils.toASCIILowerCase(qname) === 'attributename') {
+ qname = 'attributeName';
+ }
+ }
// XXX: the spec says that this next search should be done
// on the local name, but I think that is an error.
// email pending on www-dom about it.
diff --git a/test/domino.js b/test/domino.js
index 15b7d1c..c0a242d 100644
--- a/test/domino.js
+++ b/test/domino.js
@@ -987,6 +987,23 @@ exports.createSvgElements = function() {
document.body.innerHTML.should.equal("");
};
+exports.svgAttributeNameAdjustmentsFromSetAttribute = function() {
+ var document = domino.createDocument();
+ var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ var set = document.createElementNS("http://www.w3.org/2000/svg", "set");
+
+ set.setAttribute("attributename", "href");
+ set.setAttribute("to", "javascript:alert(1)");
+ svg.appendChild(set);
+ document.body.appendChild(svg);
+
+ set.getAttribute("attributeName").should.equal("href");
+ (set.getAttribute("attributename") === null).should.be.true();
+ document.body.innerHTML.should.equal(
+ ''
+ );
+};
+
exports.gh95 = function() {
var document = domino.createDocument(
'bar'