@barocss/browser 0.8.0 → 0.8.1

package/dist/cdn/barocss.js

@@ -599,6 +599,9 @@ function hasCommentDelimiter(text) {
   }
   return false;
 }
+function hasHtmlEndTagOpener(text) {
+  return text.includes("</");
+}
 function isStructureSafeValue(value) {
   if (hasCommentToken(value)) return false;
   return isSafeVariantValue(value, true);
@@ -746,8 +749,11 @@ function parseUtility(value, ctx) {
     priority
   };
 }
-const isSafePrelude = (text) => !hasCommentDelimiter(String(text ?? ""));
-const isSafeDecl = (prop, value) => isStructureSafeValue(String(prop)) && isStructureSafeValue(String(value ?? ""));
+const isSafePrelude = (text) => {
+  const t = String(text ?? "");
+  return !hasCommentDelimiter(t) && !hasHtmlEndTagOpener(t);
+};
+const isSafeDecl = (prop, value) => isStructureSafeValue(String(prop)) && isStructureSafeValue(String(value ?? "")) && !hasHtmlEndTagOpener(String(prop)) && !hasHtmlEndTagOpener(String(value ?? ""));
 const importantPrefix = "!important";
 function astToCss(ast, baseSelector, opts, _indent = "") {
   const minify = opts?.minify;
@@ -1047,7 +1053,7 @@ function animationToCssVars(animations2) {
   }
   return result;
 }
-const COMMENT_OR_BLOCK = /\/\*|\*\/|[{};]/;
+const COMMENT_OR_BLOCK = /\/\*|\*\/|[{};]|<\//;
 function keyframesBlock(name, frames) {
   if (!name || COMMENT_OR_BLOCK.test(name) || /\s/.test(name) || !frames || typeof frames !== "object") return "";
   let body = "";
@@ -1165,8 +1171,15 @@ function isSelfReferencingVar(name, value) {
   const m = /^var\(\s*(--[\w-]+)\s*(?:,[\s\S]*)?\)$/.exec(value.trim());
   return !!m && m[1] === name.trim();
 }
+const SAFE_VAR_NAME = /^--(?:[\w-]|\\\.)+$/;
+function isSafeThemeVar(name, value) {
+  if (typeof name !== "string" || !SAFE_VAR_NAME.test(name) || hasHtmlEndTagOpener(name)) return false;
+  if (typeof value !== "string" && typeof value !== "number") return false;
+  const v2 = String(value);
+  return v2.trim() !== "" && isStructureSafeValue(v2) && !hasCommentDelimiter(v2) && !hasHtmlEndTagOpener(v2);
+}
 function toCssVarsBlock(vars, extra = "") {
-  return ":root,:host {\n" + Object.entries(vars).filter(([k, v2]) => !isSelfReferencingVar(k, v2)).map(([k, v2]) => `  ${k}: ${v2};`).join("\n") + "\n}\n" + extra + "\n";
+  return ":root,:host {\n" + Object.entries(vars).filter(([k, v2]) => isSafeThemeVar(k, v2) && !isSelfReferencingVar(k, v2)).map(([k, v2]) => `  ${k}: ${v2};`).join("\n") + "\n}\n" + extra + "\n";
 }
 const BARO_VAR = /--baro-/g;
 const PREFIXED_KEYS = /* @__PURE__ */ new Set(["prop", "value", "params", "selector", "nodes", "items"]);