@getforma/core 1.0.8 → 1.0.10

package/dist/formajs-runtime.global.js

@@ -1116,7 +1116,35 @@ var FormaRuntime = (() => {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2120,7 +2148,12 @@ var FormaRuntime = (() => {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2962,7 +2995,12 @@ var FormaRuntime = (() => {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);