@getforma/core 1.0.9 → 1.0.10

package/dist/runtime.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var chunkT33QUD2Y_cjs = require('./chunk-T33QUD2Y.cjs');
+var chunk263HW3KN_cjs = require('./chunk-263HW3KN.cjs');
 var chunk6FW5E54W_cjs = require('./chunk-6FW5E54W.cjs');
 var chunkQLPCVK7C_cjs = require('./chunk-QLPCVK7C.cjs');
 
@@ -335,6 +336,11 @@ function createReconciler(config) {
 }
 
 // src/runtime.ts
+function isUnsafeAttrBinding(name, value) {
+  if (chunk263HW3KN_cjs.isEventHandlerAttr(name)) return true;
+  if (chunk263HW3KN_cjs.isUrlAttr(name) && chunk263HW3KN_cjs.isDangerousUrl(value)) return true;
+  return false;
+}
 var _refetchRegistry = /* @__PURE__ */ new Map();
 function $refetch(id) {
   const fn = _refetchRegistry.get(id);
@@ -1337,7 +1343,12 @@ function cloneAttributeTemplates(el, item) {
       if (attr.value.includes("{item")) {
         const compiled = compileTemplate(attr.value);
         entries.push({ attr: attr.name, compiled });
-        node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+        const value = evaluateCompiledTemplate(compiled, item);
+        if (isUnsafeAttrBinding(attr.name, value)) {
+          node.removeAttribute(attr.name);
+        } else {
+          node.setAttribute(attr.name, value);
+        }
       }
     }
     if (entries.length > 0) {
@@ -2179,7 +2190,12 @@ function bindElement(el, scope, disposers) {
         if (val == null || val === false) {
           el.removeAttribute(attrName);
         } else {
-          el.setAttribute(attrName, String(val));
+          const str = String(val);
+          if (isUnsafeAttrBinding(attrName, str)) {
+            el.removeAttribute(attrName);
+          } else {
+            el.setAttribute(attrName, str);
+          }
         }
       });
       disposers.push(dispose);