@constela/start 1.3.3 → 1.3.5

package/README.md

@@ -227,6 +227,22 @@ title: Getting Started
 </Callout>
 ```
 
+### Security
+
+MDX attribute expressions are validated at compile time. Dangerous patterns like `require()`, `eval()`, or `window` in actual code will throw explicit errors:
+
+```mdx
+<!-- Error: MDX attribute contains disallowed pattern: require -->
+<Button data={require("module")} />
+```
+
+However, these words are allowed inside string literals:
+
+```mdx
+<!-- OK: "require" is inside a string literal -->
+<PropsTable items={[{ description: "operations that require one" }]} />
+```
+
 ## Configuration
 
 Create `constela.config.json`:

package/dist/{chunk-2P567CIH.js → chunk-QEXDD2F2.js}

@@ -351,16 +351,56 @@ var DISALLOWED_PATTERNS = [
   /\bconstructor\b/,
   /\bprototype\b/
 ];
+function extractCodeOutsideStrings(value) {
+  let result = "";
+  let i = 0;
+  while (i < value.length) {
+    const char = value[i];
+    if (char === '"' || char === "'" || char === "`") {
+      const quote = char;
+      i++;
+      while (i < value.length) {
+        if (value[i] === "\\" && i + 1 < value.length) {
+          i += 2;
+        } else if (value[i] === quote) {
+          i++;
+          break;
+        } else {
+          i++;
+        }
+      }
+    } else {
+      result += char;
+      i++;
+    }
+  }
+  return result;
+}
 function isSafeLiteral(value) {
-  return !DISALLOWED_PATTERNS.some((pattern) => pattern.test(value));
+  const codeOnly = extractCodeOutsideStrings(value);
+  for (const pattern of DISALLOWED_PATTERNS) {
+    if (pattern.test(codeOnly)) {
+      const patternStr = pattern.source;
+      const match = patternStr.match(/\\b\(?([\w|]+)\)?\\b/);
+      const matchedName = match?.[1] ?? patternStr;
+      return { safe: false, matchedPattern: matchedName };
+    }
+  }
+  return { safe: true };
 }
-function safeEvalLiteral(value) {
+function safeEvalLiteral(value, attributeName) {
   try {
     return JSON.parse(value);
   } catch {
   }
-  if (!isSafeLiteral(value)) {
-    return null;
+  const safetyCheck = isSafeLiteral(value);
+  if (!safetyCheck.safe) {
+    const truncatedValue = value.length > 100 ? value.slice(0, 100) + "..." : value;
+    throw new Error(
+      `MDX attribute contains disallowed pattern: ${safetyCheck.matchedPattern}
+Attribute: ${attributeName ?? "unknown"}
+Value: "${truncatedValue}"`
+    );
   }
   try {
     const fn = new Function(`return (${value});`);
@@ -369,6 +409,17 @@ function safeEvalLiteral(value) {
     return null;
   }
 }
+function checkExpressionSecurity(exprValue, attributeName) {
+  const safetyCheck = isSafeLiteral(exprValue);
+  if (!safetyCheck.safe) {
+    const truncatedValue = exprValue.length > 100 ? exprValue.slice(0, 100) + "..." : exprValue;
+    throw new Error(
+      `MDX attribute contains disallowed pattern: ${safetyCheck.matchedPattern}
+Attribute: ${attributeName}
+Value: "${truncatedValue}"`
+    );
+  }
+}
 function parseAttributeValue(attr) {
   if (attr.value === null) {
     return lit(true);
@@ -383,8 +434,9 @@ function parseAttributeValue(attr) {
     if (exprValue === "null") return lit(null);
     const num = Number(exprValue);
     if (!Number.isNaN(num)) return lit(num);
+    checkExpressionSecurity(exprValue, attr.name);
     if (exprValue.startsWith("[") || exprValue.startsWith("{")) {
-      const parsed = safeEvalLiteral(exprValue);
+      const parsed = safeEvalLiteral(exprValue, attr.name);
       if (parsed !== null && parsed !== void 0) {
         return lit(parsed);
       }

package/dist/cli/index.js

@@ -4,7 +4,7 @@ import {
   hyperlink,
   loadConfig,
   resolveConfig
-} from "../chunk-2P567CIH.js";
+} from "../chunk-QEXDD2F2.js";
 import "../chunk-CYMS3K6V.js";
 
 // src/cli/index.ts

package/dist/index.js

@@ -24,7 +24,7 @@ import {
   transformCsv,
   transformMdx,
   transformYaml
-} from "./chunk-2P567CIH.js";
+} from "./chunk-QEXDD2F2.js";
 import {
   generateHydrationScript,
   renderPage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constela/start",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Meta-framework for Constela applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -43,11 +43,11 @@
     "postcss": "^8.5.0",
     "@tailwindcss/postcss": "^4.0.0",
     "tailwindcss": "^4.0.0",
-    "@constela/core": "0.9.1",
-    "@constela/router": "10.0.0",
-    "@constela/compiler": "0.9.1",
-    "@constela/runtime": "0.12.2",
-    "@constela/server": "5.0.1"
+    "@constela/core": "0.10.0",
+    "@constela/compiler": "0.10.0",
+    "@constela/router": "11.0.0",
+    "@constela/runtime": "0.13.0",
+    "@constela/server": "6.0.0"
   },
   "devDependencies": {
     "@types/mdast": "^4.0.4",