@getforma/core 1.0.9 → 1.0.10

package/dist/runtime.js

@@ -1,4 +1,5 @@
 import { reconcileList } from './chunk-AFRFF7XL.js';
+import { isEventHandlerAttr, isUrlAttr, isDangerousUrl } from './chunk-2QQBKQIF.js';
 import { internalEffect, batch } from './chunk-3G7ET4O5.js';
 import { createSignal, createComputed } from './chunk-HLM5BZZQ.js';
 
@@ -333,6 +334,11 @@ function createReconciler(config) {
 }
 
 // src/runtime.ts
+function isUnsafeAttrBinding(name, value) {
+  if (isEventHandlerAttr(name)) return true;
+  if (isUrlAttr(name) && isDangerousUrl(value)) return true;
+  return false;
+}
 var _refetchRegistry = /* @__PURE__ */ new Map();
 function $refetch(id) {
   const fn = _refetchRegistry.get(id);
@@ -1335,7 +1341,12 @@ function cloneAttributeTemplates(el, item) {
       if (attr.value.includes("{item")) {
         const compiled = compileTemplate(attr.value);
         entries.push({ attr: attr.name, compiled });
-        node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+        const value = evaluateCompiledTemplate(compiled, item);
+        if (isUnsafeAttrBinding(attr.name, value)) {
+          node.removeAttribute(attr.name);
+        } else {
+          node.setAttribute(attr.name, value);
+        }
       }
     }
     if (entries.length > 0) {
@@ -2177,7 +2188,12 @@ function bindElement(el, scope, disposers) {
         if (val == null || val === false) {
           el.removeAttribute(attrName);
         } else {
-          el.setAttribute(attrName, String(val));
+          const str = String(val);
+          if (isUnsafeAttrBinding(attrName, str)) {
+            el.removeAttribute(attrName);
+          } else {
+            el.setAttribute(attrName, str);
+          }
         }
       });
       disposers.push(dispose);