@getforma/core 1.0.9 → 1.0.10

package/README.md

@@ -5,7 +5,7 @@
 [![Socket Badge](https://socket.dev/api/badge/npm/package/@getforma/core)](https://socket.dev/npm/package/@getforma/core)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-Reactive DOM library with fine-grained signals. No virtual DOM — signals update only the DOM nodes that changed. Components run once. ~15 KB gzipped.
+Reactive DOM library with fine-grained signals. No virtual DOM — signals update only the DOM nodes that changed. Components run once. The core entry (`@getforma/core`) is ~8 KB gzipped; the full HTML runtime bundle (`formajs-runtime.global.js`) is ~24 KB gzipped.
 
 ```tsx
 import { createSignal, h, mount } from "@getforma/core";

package/dist/chunk-263HW3KN.cjs

@@ -0,0 +1,35 @@
+'use strict';
+
+// src/security/url-safety.ts
+var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+var URL_ATTRS = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "poster",
+  "background"
+]);
+function isUrlAttr(name) {
+  return URL_ATTRS.has(name.toLowerCase());
+}
+function isDangerousUrl(value) {
+  const normalized = value.replace(URL_IGNORED_CHARS_RE, "");
+  return DANGEROUS_SCHEME_RE.test(normalized);
+}
+function isEventHandlerAttr(name) {
+  return /^on/i.test(name);
+}
+var SAFE_ATTR_NAME_RE = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;
+function isSafeAttrName(name) {
+  return SAFE_ATTR_NAME_RE.test(name);
+}
+
+exports.isDangerousUrl = isDangerousUrl;
+exports.isEventHandlerAttr = isEventHandlerAttr;
+exports.isSafeAttrName = isSafeAttrName;
+exports.isUrlAttr = isUrlAttr;
+//# sourceMappingURL=chunk-263HW3KN.cjs.map
+//# sourceMappingURL=chunk-263HW3KN.cjs.map

package/dist/chunk-263HW3KN.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/url-safety.ts"],"names":[],"mappings":";;;AAgBA,IAAM,oBAAA,GAAuB,+BAAA;AAK7B,IAAM,mBAAA,GAAsB,2CAAA;AAGrB,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EAC/B,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGM,SAAS,UAAU,IAAA,EAAuB;AAC/C,EAAA,OAAO,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,WAAA,EAAa,CAAA;AACzC;AAMO,SAAS,eAAe,KAAA,EAAwB;AACrD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,oBAAA,EAAsB,EAAE,CAAA;AACzD,EAAA,OAAO,mBAAA,CAAoB,KAAK,UAAU,CAAA;AAC5C;AAGO,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,OAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACzB;AAKA,IAAM,iBAAA,GAAoB,8BAAA;AAGnB,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,OAAO,iBAAA,CAAkB,KAAK,IAAI,CAAA;AACpC","file":"chunk-263HW3KN.cjs","sourcesContent":["/**\n * URL / attribute safety helpers shared by the SSR renderer (`src/ssr`) and the\n * DOM runtime (`src/runtime.ts`).\n *\n * The subtle part is scheme detection. Browsers strip ASCII whitespace and C0\n * control characters out of a URL before resolving its scheme, so\n * `java\\tscript:alert(1)`, `javas\\ncript:...` and `\\x01javascript:...` all\n * execute even though a naive `/^javascript:/` test does not match them. We\n * normalize the value the same way the browser does *before* testing.\n *\n * This module has no dependencies so it can be pulled into every build variant\n * (standard, hardened/CSP, SSR) cheaply.\n */\n\n// C0 controls + space (0x00-0x20), DEL and C1 controls (0x7F-0x9F). These are\n// exactly the bytes a URL parser ignores/strips when reading the scheme.\nconst URL_IGNORED_CHARS_RE = /[\\u0000-\\u0020\\u007F-\\u009F]/g;\n\n// Schemes that can execute script or smuggle an active HTML document.\n// Kept intentionally narrow to avoid blocking legitimate `data:image/*` inline\n// assets; `data:image/svg+xml` in a navigable context is handled separately.\nconst DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\\/html)/i;\n\n/** Attributes whose values are resolved as URLs and must be scheme-checked. */\nexport const URL_ATTRS = new Set([\n  'href',\n  'src',\n  'action',\n  'formaction',\n  'xlink:href',\n  'poster',\n  'background',\n]);\n\n/** True if `name` is a URL-bearing attribute (case-insensitive). */\nexport function isUrlAttr(name: string): boolean {\n  return URL_ATTRS.has(name.toLowerCase());\n}\n\n/**\n * True if `value` uses a scheme that can execute script, after normalizing away\n * the whitespace and control characters that browsers ignore in a URL scheme.\n */\nexport function isDangerousUrl(value: string): boolean {\n  const normalized = value.replace(URL_IGNORED_CHARS_RE, '');\n  return DANGEROUS_SCHEME_RE.test(normalized);\n}\n\n/** True for any `on…` event-handler attribute name (case-insensitive). */\nexport function isEventHandlerAttr(name: string): boolean {\n  return /^on/i.test(name);\n}\n\n// A well-formed HTML attribute name: starts with a letter/`_`/`:`, followed by\n// letters, digits, `-`, `_`, `:` or `.`. Rejects whitespace, `=`, quotes and\n// `/`, which is what an attacker needs to break out and inject a new attribute.\nconst SAFE_ATTR_NAME_RE = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;\n\n/** True if `name` is safe to emit verbatim as an attribute name. */\nexport function isSafeAttrName(name: string): boolean {\n  return SAFE_ATTR_NAME_RE.test(name);\n}\n"]}

package/dist/chunk-2QQBKQIF.js

@@ -0,0 +1,30 @@
+// src/security/url-safety.ts
+var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+var URL_ATTRS = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "poster",
+  "background"
+]);
+function isUrlAttr(name) {
+  return URL_ATTRS.has(name.toLowerCase());
+}
+function isDangerousUrl(value) {
+  const normalized = value.replace(URL_IGNORED_CHARS_RE, "");
+  return DANGEROUS_SCHEME_RE.test(normalized);
+}
+function isEventHandlerAttr(name) {
+  return /^on/i.test(name);
+}
+var SAFE_ATTR_NAME_RE = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;
+function isSafeAttrName(name) {
+  return SAFE_ATTR_NAME_RE.test(name);
+}
+
+export { isDangerousUrl, isEventHandlerAttr, isSafeAttrName, isUrlAttr };
+//# sourceMappingURL=chunk-2QQBKQIF.js.map
+//# sourceMappingURL=chunk-2QQBKQIF.js.map

package/dist/chunk-2QQBKQIF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/url-safety.ts"],"names":[],"mappings":";AAgBA,IAAM,oBAAA,GAAuB,+BAAA;AAK7B,IAAM,mBAAA,GAAsB,2CAAA;AAGrB,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EAC/B,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGM,SAAS,UAAU,IAAA,EAAuB;AAC/C,EAAA,OAAO,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,WAAA,EAAa,CAAA;AACzC;AAMO,SAAS,eAAe,KAAA,EAAwB;AACrD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,oBAAA,EAAsB,EAAE,CAAA;AACzD,EAAA,OAAO,mBAAA,CAAoB,KAAK,UAAU,CAAA;AAC5C;AAGO,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,OAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AACzB;AAKA,IAAM,iBAAA,GAAoB,8BAAA;AAGnB,SAAS,eAAe,IAAA,EAAuB;AACpD,EAAA,OAAO,iBAAA,CAAkB,KAAK,IAAI,CAAA;AACpC","file":"chunk-2QQBKQIF.js","sourcesContent":["/**\n * URL / attribute safety helpers shared by the SSR renderer (`src/ssr`) and the\n * DOM runtime (`src/runtime.ts`).\n *\n * The subtle part is scheme detection. Browsers strip ASCII whitespace and C0\n * control characters out of a URL before resolving its scheme, so\n * `java\\tscript:alert(1)`, `javas\\ncript:...` and `\\x01javascript:...` all\n * execute even though a naive `/^javascript:/` test does not match them. We\n * normalize the value the same way the browser does *before* testing.\n *\n * This module has no dependencies so it can be pulled into every build variant\n * (standard, hardened/CSP, SSR) cheaply.\n */\n\n// C0 controls + space (0x00-0x20), DEL and C1 controls (0x7F-0x9F). These are\n// exactly the bytes a URL parser ignores/strips when reading the scheme.\nconst URL_IGNORED_CHARS_RE = /[\\u0000-\\u0020\\u007F-\\u009F]/g;\n\n// Schemes that can execute script or smuggle an active HTML document.\n// Kept intentionally narrow to avoid blocking legitimate `data:image/*` inline\n// assets; `data:image/svg+xml` in a navigable context is handled separately.\nconst DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\\/html)/i;\n\n/** Attributes whose values are resolved as URLs and must be scheme-checked. */\nexport const URL_ATTRS = new Set([\n  'href',\n  'src',\n  'action',\n  'formaction',\n  'xlink:href',\n  'poster',\n  'background',\n]);\n\n/** True if `name` is a URL-bearing attribute (case-insensitive). */\nexport function isUrlAttr(name: string): boolean {\n  return URL_ATTRS.has(name.toLowerCase());\n}\n\n/**\n * True if `value` uses a scheme that can execute script, after normalizing away\n * the whitespace and control characters that browsers ignore in a URL scheme.\n */\nexport function isDangerousUrl(value: string): boolean {\n  const normalized = value.replace(URL_IGNORED_CHARS_RE, '');\n  return DANGEROUS_SCHEME_RE.test(normalized);\n}\n\n/** True for any `on…` event-handler attribute name (case-insensitive). */\nexport function isEventHandlerAttr(name: string): boolean {\n  return /^on/i.test(name);\n}\n\n// A well-formed HTML attribute name: starts with a letter/`_`/`:`, followed by\n// letters, digits, `-`, `_`, `:` or `.`. Rejects whitespace, `=`, quotes and\n// `/`, which is what an attacker needs to break out and inject a new attribute.\nconst SAFE_ATTR_NAME_RE = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;\n\n/** True if `name` is safe to emit verbatim as an attribute name. */\nexport function isSafeAttrName(name: string): boolean {\n  return SAFE_ATTR_NAME_RE.test(name);\n}\n"]}

package/dist/forma-runtime-csp.js

@@ -1047,7 +1047,35 @@ var FormaRuntime = (function (exports) {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2012,7 +2040,12 @@ var FormaRuntime = (function (exports) {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2784,7 +2817,12 @@ var FormaRuntime = (function (exports) {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);

package/dist/forma-runtime.js

@@ -1116,7 +1116,35 @@ var FormaRuntime = (() => {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2120,7 +2148,12 @@ var FormaRuntime = (() => {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2962,7 +2995,12 @@ var FormaRuntime = (() => {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);

package/dist/formajs-runtime-hardened.global.js

@@ -1047,7 +1047,35 @@ var FormaRuntime = (function (exports) {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2012,7 +2040,12 @@ var FormaRuntime = (function (exports) {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2784,7 +2817,12 @@ var FormaRuntime = (function (exports) {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);