Step 1.5.9.3 of "sanitize core" reads:

If configuration["attributes"] does not contain attrName and elementWithLocalAttributes["attributes"] with default « » does not contain attrName, and if "data-" is not a code unit prefix of attribute’s local name and namespace is not null or configuration["dataAttributes"] is not true:

In particular the following sub-condition:

if "data-" is not a code unit prefix of attribute’s local name and namespace is not null

Seems wrong to me. Would this not allow an attribute whose local name does not begin with "data-" but whose namespace is null, when data attributes are allowed? It seems to me like "and" should be "or".