@getforma/core 1.0.9 → 1.1.0

package/dist/runtime-hardened.js

@@ -1,10 +1,33 @@
 import { signal, computed, effect, setActiveSub, startBatch, endBatch } from 'alien-signals';
 
 // src/reactive/signal.ts
+
+// src/reactive/dev.ts
+function isDev() {
+  if (typeof process !== "undefined") {
+    return process.env?.NODE_ENV !== "production";
+  }
+  return typeof __FORMA_DEV__ !== "undefined" ? !!__FORMA_DEV__ : false;
+}
+isDev();
+var _errorHandlers = /* @__PURE__ */ new Set();
+function reportError(error, source) {
+  for (const handler of _errorHandlers) {
+    try {
+      handler(error, source ? { source } : {});
+    } catch {
+    }
+  }
+  if (isDev()) {
+    console.error(`[forma] ${source} error:`, error);
+  }
+}
 function applySignalSet(s, v, equals) {
   if (typeof v !== "function") {
-    s(v);
-    return;
+    {
+      s(v);
+      return;
+    }
   }
   const prevSub = setActiveSub(void 0);
   const prev = s();
@@ -22,8 +45,35 @@ function internalEffect(fn) {
   const dispose = effect(fn);
   return dispose;
 }
+var ERR = /* @__PURE__ */ Symbol("formaComputedError");
+function isErrBox(v) {
+  return typeof v === "object" && v !== null && ERR in v;
+}
 function createComputed(fn) {
-  return computed(fn);
+  let errored = false;
+  let error;
+  let lastGood;
+  const raw = computed(() => {
+    try {
+      const v = fn(lastGood);
+      errored = false;
+      error = void 0;
+      lastGood = v;
+      return v;
+    } catch (e) {
+      errored = true;
+      error = e;
+      reportError(e, "computed");
+      return { [ERR]: e };
+    }
+  });
+  const reader = () => {
+    const v = raw();
+    if (errored || isErrBox(v)) throw error;
+    return v;
+  };
+  Object.defineProperty(reader, "name", { value: raw.name, configurable: true });
+  return reader;
 }
 function batch(fn) {
   startBatch();
@@ -605,7 +655,35 @@ function createReconciler(config) {
   };
 }
 
+// src/security/url-safety.ts
+var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+var URL_ATTRS = /* @__PURE__ */ new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "poster",
+  "background"
+]);
+function isUrlAttr(name) {
+  return URL_ATTRS.has(name.toLowerCase());
+}
+function isDangerousUrl(value2) {
+  const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+  return DANGEROUS_SCHEME_RE.test(normalized);
+}
+function isEventHandlerAttr(name) {
+  return /^on/i.test(name);
+}
+
 // src/runtime.ts
+function isUnsafeAttrBinding(name, value2) {
+  if (isEventHandlerAttr(name)) return true;
+  if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+  return false;
+}
 var _refetchRegistry = /* @__PURE__ */ new Map();
 function $refetch(id) {
   const fn = _refetchRegistry.get(id);
@@ -1570,7 +1648,12 @@ function cloneAttributeTemplates(el, item) {
       if (attr.value.includes("{item")) {
         const compiled = compileTemplate(attr.value);
         entries.push({ attr: attr.name, compiled });
-        node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+        const value2 = evaluateCompiledTemplate(compiled, item);
+        if (isUnsafeAttrBinding(attr.name, value2)) {
+          node.removeAttribute(attr.name);
+        } else {
+          node.setAttribute(attr.name, value2);
+        }
       }
     }
     if (entries.length > 0) {
@@ -2342,7 +2425,12 @@ function bindElement(el, scope, disposers) {
         if (val == null || val === false) {
           el.removeAttribute(attrName);
         } else {
-          el.setAttribute(attrName, String(val));
+          const str = String(val);
+          if (isUnsafeAttrBinding(attrName, str)) {
+            el.removeAttribute(attrName);
+          } else {
+            el.setAttribute(attrName, str);
+          }
         }
       });
       disposers.push(dispose);