@geomak/ui 1.7.3 → 1.7.4

package/dist/index.js

@@ -2328,8 +2328,24 @@ function toCssVars(theme) {
   }
   return out;
 }
+var CSS_VALUE_REJECT_RE = /[;{}<>\\]|\*\/|\/\*/;
+function isSafeCssValue(v) {
+  if (typeof v !== "string") return false;
+  if (v.length > 500) return false;
+  return !CSS_VALUE_REJECT_RE.test(v);
+}
 function varsToStyleString(vars2) {
-  return Object.entries(vars2).map(([k, v]) => `${k}: ${v};`).join(" ");
+  const out = [];
+  for (const [k, v] of Object.entries(vars2)) {
+    if (!isSafeCssValue(v)) {
+      console.warn(
+        `[ThemeProvider] Dropping unsafe value for "${k}". Theme values may contain letters, digits, and CSS punctuation but must not include: ; { } < > \\ /* */`
+      );
+      continue;
+    }
+    out.push(`${k}: ${v};`);
+  }
+  return out.join(" ");
 }
 function ThemeProvider({
   theme,