@flux-ui/statistics 3.0.0-next.71 → 3.0.0-next.73

package/dist/index.js

@@ -130,13 +130,39 @@ function deepResolveCssVars(value, root) {
 	return changed ? out : value;
 }
 //#endregion
+//#region src/util/html.ts
+var HTML_ESCAPES = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+var HTML_PATTERN = /[&<>"']/g;
+var ATTR_PATTERN = /[&<>"]/g;
+/**
+* Escapes a value for safe interpolation into HTML text content.
+*/
+function escapeHtml(value) {
+	return String(value ?? "").replace(HTML_PATTERN, (char) => HTML_ESCAPES[char]);
+}
+/**
+* Escapes a value for safe interpolation into a double-quoted HTML attribute
+* or inline style value. Prevents attribute breakout from untrusted input.
+*/
+function escapeAttr(value) {
+	return String(value ?? "").replace(ATTR_PATTERN, (char) => HTML_ESCAPES[char]);
+}
+//#endregion
 //#region src/util/icons.ts
 function renderIconSvg(name, color, size = 14) {
 	if (!name) return "";
 	const icon = iconRegistry[name];
 	if (!icon) return "";
 	const [width, height, , , pathData] = icon;
-	return `<svg viewBox="0 0 ${width} ${height}" width="${size}" height="${size}" focusable="false" aria-hidden="true">${(Array.isArray(pathData) ? pathData : [pathData]).map((d) => `<path d="${d}" fill="${color}"/>`).join("")}</svg>`;
+	const paths = Array.isArray(pathData) ? pathData : [pathData];
+	const safeColor = escapeAttr(color);
+	return `<svg viewBox="0 0 ${width} ${height}" width="${size}" height="${size}" focusable="false" aria-hidden="true">${paths.map((d) => `<path d="${escapeAttr(d)}" fill="${safeColor}"/>`).join("")}</svg>`;
 }
 //#endregion
 //#region src/util/series/chartColors.ts
@@ -6782,7 +6808,7 @@ function friendlyDateTime(dateTimeish) {
 	else throw new InvalidArgumentError(`Unknown datetime argument: ${dateTimeish}, of type ${typeof dateTimeish}`);
 }
 //#endregion
-//#region ../../node_modules/.bun/@basmilius+utils@3.35.0+f2ed1ec6a4c7f7fd/node_modules/@basmilius/utils/dist/index.mjs
+//#region ../../node_modules/.bun/@basmilius+utils@3.37.0+f2ed1ec6a4c7f7fd/node_modules/@basmilius/utils/dist/index.mjs
 function p$2(e, t = 0) {
 	let n = typeof navigator < `u` ? navigator.language : `nl-NL`;
 	return new Intl.NumberFormat(n, {
@@ -6822,17 +6848,18 @@ function K(e, t, n) {
 //#region src/util/tooltips/render.ts
 function renderTooltip(t, styles, title, items, activeIndex = -1, valueFormatter) {
 	if (items.length === 0) return "";
-	const titleHtml = title ? `<div class="${styles.statisticsChartTooltipTitle}">${title}</div>` : "";
+	const titleHtml = title ? `<div class="${styles.statisticsChartTooltipTitle}">${escapeHtml(title)}</div>` : "";
 	const hasActive = activeIndex !== -1;
 	const body = items.map((item, idx) => {
 		const activeClass = !hasActive || idx === activeIndex ? ` ${styles.isActive}` : "";
 		const translatedName = item.name ? t(String(item.name)) : "";
-		const marker = item.icon ? `<div class="${styles.statisticsChartTooltipSeriesIcon}${activeClass}" style="color: ${item.color}">${renderIconSvg(item.icon, item.color, 14)}</div>` : `<div class="${styles.statisticsChartTooltipSeriesColor}${activeClass}" style="background: ${item.color}"></div>`;
+		const safeColor = escapeAttr(item.color);
+		const marker = item.icon ? `<div class="${styles.statisticsChartTooltipSeriesIcon}${activeClass}" style="color: ${safeColor}">${renderIconSvg(item.icon, item.color, 14)}</div>` : `<div class="${styles.statisticsChartTooltipSeriesColor}${activeClass}" style="background: ${safeColor}"></div>`;
 		const display = valueFormatter ? valueFormatter(item.value, item) : formatValue(item.value);
 		return `
             ${marker}
-            <div class="${styles.statisticsChartTooltipSeriesName}${activeClass}">${translatedName}</div>
-            <div class="${styles.statisticsChartTooltipSeriesValue}${activeClass}">${display}</div>
+            <div class="${styles.statisticsChartTooltipSeriesName}${activeClass}">${escapeHtml(translatedName)}</div>
+            <div class="${styles.statisticsChartTooltipSeriesValue}${activeClass}">${escapeHtml(display)}</div>
         `;
 	}).join("");
 	return `<div class="${styles.statisticsChartTooltip}">${titleHtml}<div class="${styles.statisticsChartTooltipBody}">${body}</div></div>`;
@@ -10740,7 +10767,7 @@ useMode(definition$2);
 useMode(definition$1);
 useMode(definition);
 //#endregion
-//#region ../../node_modules/.bun/@basmilius+http-client@3.35.0+f97c77f67c914c00/node_modules/@basmilius/http-client/dist/index.mjs
+//#region ../../node_modules/.bun/@basmilius+http-client@3.37.0+f97c77f67c914c00/node_modules/@basmilius/http-client/dist/index.mjs
 function adapter_default(Parent) {
 	return class extends Parent {
 		constructor(...args) {
@@ -10748,6 +10775,11 @@ function adapter_default(Parent) {
 		}
 	};
 }
+function bound_default() {
+	return (target, method) => {
+		target[method] = target[method].bind(target);
+	};
+}
 /**
 * Checks if the two given values are equal. When both values are a
 * dto, the check is done by firstly converthing them to JSON.
@@ -10771,7 +10803,7 @@ var TRIGGER = Symbol();
 * Checks if the given object is a dto.
 */
 function isDto_default(obj) {
-	return obj && typeof obj === "object" && !!obj[NAME];
+	return typeof obj === "object" && obj !== null && NAME in obj;
 }
 /**
 * Asserts that the given object is a dto.
@@ -10826,6 +10858,9 @@ var markDtoClean = circularProtect_default(function(obj) {
 	if (!obj[CHILDREN] || obj[CHILDREN].length === 0) return;
 	obj[CHILDREN].filter(isDtoDirty_default).forEach(markDtoClean);
 });
+function isProxiedArray_default(value) {
+	return Array.isArray(value) && PARENT in value;
+}
 /**
 * Marks the given dto dirty.
 */
@@ -10852,7 +10887,7 @@ function relateDtoTo_default(dto, parent, key) {
 */
 function relateValueTo_default(dto, key, value) {
 	if (isDto_default(value)) relateDtoTo_default(value, dto, key);
-	else if (Array.isArray(value)) {
+	else if (isProxiedArray_default(value)) {
 		for (const item of value) {
 			if (!isDto_default(item)) continue;
 			relateDtoTo_default(item, dto, key);
@@ -10884,7 +10919,7 @@ function unrelateDtoFrom_default(dto, parent) {
 */
 function unrelateValueFrom_default(dto, value) {
 	if (isDto_default(value)) unrelateDtoFrom_default(value, dto);
-	else if (Array.isArray(value)) {
+	else if (isProxiedArray_default(value)) {
 		for (const item of value) if (isDto_default(item)) unrelateDtoFrom_default(item, dto);
 		value[PARENT] = void 0;
 		value[PARENT_KEY] = void 0;
@@ -10928,7 +10963,7 @@ var arrayProxy_default = {
 	}
 };
 /**
-* Checks if the given key should be ignored by the proxy.
+* Checks if the proxy should ignore the given key.
 */
 function ignored(target, key) {
 	return typeof key === "symbol" || typeof target[key] === "function" || key === "length";
@@ -10973,7 +11008,7 @@ var instanceProxy_default = {
 		const oldValue = descriptor.get?.call(target) ?? void 0;
 		if (areEqual_default(value, oldValue)) return true;
 		unrelateValueFrom_default(target, oldValue);
-		if (Array.isArray(value) && !value[PROXY]) value = new Proxy(value, arrayProxy_default);
+		if (Array.isArray(value) && !isProxiedArray_default(value)) value = new Proxy(value, arrayProxy_default);
 		descriptor.set.call(target, value);
 		relateValueTo_default(target, key, value);
 		markDtoDirty(target, key);
@@ -11097,7 +11132,7 @@ function dto_default(clazz) {
 	K(clazz.prototype, DESCRIPTORS, descriptors);
 	K(clazz.prototype, NAME, clazz.name);
 	K(clazz.prototype, PROPERTIES, properties);
-	K(clazz, Symbol.hasInstance, (instance) => typeof instance === "object" && instance?.[NAME] === clazz.name);
+	K(clazz, Symbol.hasInstance, (instance) => typeof instance === "object" && instance !== null && NAME in instance && instance[NAME] === clazz.name);
 	G$1(clazz, "clone", clone_default);
 	G$1(clazz, "fill", fill_default);
 	G$1(clazz, "toJSON", toJSON_default);
@@ -11118,6 +11153,12 @@ function __decorate(decorators, target, key, desc) {
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
+var X = class {
+	test() {
+		return true;
+	}
+};
+__decorate([bound_default()], X.prototype, "test", null);
 var BlobResponse = class BlobResponse {
 	get blob() {
 		return this.#blob;
@@ -11230,7 +11271,7 @@ var HttpAdapter = _HttpAdapter = class HttpAdapter {
 		const defaultFilename = `download-${DateTime.now().toFormat("yyyy-MM-dd HH-mm-ss")}`;
 		if (!header.startsWith("attachment")) return defaultFilename;
 		const matches = /filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/.exec(header);
-		if ((matches?.length || 0) < 2) return defaultFilename;
+		if (!matches || matches.length < 2) return defaultFilename;
 		return matches[1].replaceAll("'", "").replaceAll("\"", "").replaceAll("/", "-").replaceAll(":", "-");
 	}
 	static parseRequestError(data, statusCode) {
@@ -11238,12 +11279,7 @@ var HttpAdapter = _HttpAdapter = class HttpAdapter {
 	}
 	static parseValidationError(data) {
 		let errors;
-		if (data.errors) {
-			errors = {};
-			Object.entries(data.errors).forEach(([key, value]) => {
-				errors[key] = _HttpAdapter.parseValidationError(value);
-			});
-		}
+		if (data.errors) errors = Object.fromEntries(Object.entries(data.errors).map(([key, value]) => [key, _HttpAdapter.parseValidationError(value)]));
 		return new ValidationError_default(data.code, data.error, data.error_description, errors, data.params);
 	}
 };