@getforma/core 1.0.9 → 1.0.10

package/dist/runtime-hardened.cjs

@@ -607,7 +607,35 @@ function createReconciler(config) {
   };
 }
 
+// src/security/url-safety.ts
+var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+var URL_ATTRS = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "poster",
+  "background"
+]);
+function isUrlAttr(name) {
+  return URL_ATTRS.has(name.toLowerCase());
+}
+function isDangerousUrl(value2) {
+  const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+  return DANGEROUS_SCHEME_RE.test(normalized);
+}
+function isEventHandlerAttr(name) {
+  return /^on/i.test(name);
+}
+
 // src/runtime.ts
+function isUnsafeAttrBinding(name, value2) {
+  if (isEventHandlerAttr(name)) return true;
+  if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+  return false;
+}
 var _refetchRegistry = /* @__PURE__ */ new Map();
 function $refetch(id) {
   const fn = _refetchRegistry.get(id);
@@ -1572,7 +1600,12 @@ function cloneAttributeTemplates(el, item) {
       if (attr.value.includes("{item")) {
         const compiled = compileTemplate(attr.value);
         entries.push({ attr: attr.name, compiled });
-        node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+        const value2 = evaluateCompiledTemplate(compiled, item);
+        if (isUnsafeAttrBinding(attr.name, value2)) {
+          node.removeAttribute(attr.name);
+        } else {
+          node.setAttribute(attr.name, value2);
+        }
       }
     }
     if (entries.length > 0) {
@@ -2344,7 +2377,12 @@ function bindElement(el, scope, disposers) {
         if (val == null || val === false) {
           el.removeAttribute(attrName);
         } else {
-          el.setAttribute(attrName, String(val));
+          const str = String(val);
+          if (isUnsafeAttrBinding(attrName, str)) {
+            el.removeAttribute(attrName);
+          } else {
+            el.setAttribute(attrName, str);
+          }
         }
       });
       disposers.push(dispose);