I noticed that we check that data-* attributes are allowed in both XHTML and SVG content documents but we don't appear to be enforcing the naming restrictions in the HTML specification -- specifically that the name can't begin with "xml" or contain upper-ascii characters.

https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes