@getforma/core 1.0.9 → 1.1.0

package/dist/formajs-runtime-hardened.global.js

@@ -438,11 +438,32 @@ var FormaRuntime = (function (exports) {
     }
   }
 
-  // src/reactive/signal.ts
+  // src/reactive/dev.ts
+  function isDev() {
+    if (typeof process !== "undefined") {
+      return process.env?.NODE_ENV !== "production";
+    }
+    return typeof __FORMA_DEV__ !== "undefined" ? !!__FORMA_DEV__ : false;
+  }
+  isDev();
+  var _errorHandlers = /* @__PURE__ */ new Set();
+  function reportError(error, source) {
+    for (const handler of _errorHandlers) {
+      try {
+        handler(error, source ? { source } : {});
+      } catch {
+      }
+    }
+    if (isDev()) {
+      console.error(`[forma] ${source} error:`, error);
+    }
+  }
   function applySignalSet(s, v, equals) {
     if (typeof v !== "function") {
-      s(v);
-      return;
+      {
+        s(v);
+        return;
+      }
     }
     const prevSub = setActiveSub(void 0);
     const prev = s();
@@ -462,8 +483,35 @@ var FormaRuntime = (function (exports) {
   }
 
   // src/reactive/computed.ts
+  var ERR = /* @__PURE__ */ Symbol("formaComputedError");
+  function isErrBox(v) {
+    return typeof v === "object" && v !== null && ERR in v;
+  }
   function createComputed(fn) {
-    return computed(fn);
+    let errored = false;
+    let error;
+    let lastGood;
+    const raw = computed(() => {
+      try {
+        const v = fn(lastGood);
+        errored = false;
+        error = void 0;
+        lastGood = v;
+        return v;
+      } catch (e) {
+        errored = true;
+        error = e;
+        reportError(e, "computed");
+        return { [ERR]: e };
+      }
+    });
+    const reader = () => {
+      const v = raw();
+      if (errored || isErrBox(v)) throw error;
+      return v;
+    };
+    Object.defineProperty(reader, "name", { value: raw.name, configurable: true });
+    return reader;
   }
 
   // src/reactive/batch.ts
@@ -1047,7 +1095,35 @@ var FormaRuntime = (function (exports) {
     };
   }
 
+  // src/security/url-safety.ts
+  var URL_IGNORED_CHARS_RE = /[\u0000-\u0020\u007F-\u009F]/g;
+  var DANGEROUS_SCHEME_RE = /^(?:javascript|vbscript|data:text\/html)/i;
+  var URL_ATTRS = /* @__PURE__ */ new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+    "poster",
+    "background"
+  ]);
+  function isUrlAttr(name) {
+    return URL_ATTRS.has(name.toLowerCase());
+  }
+  function isDangerousUrl(value2) {
+    const normalized = value2.replace(URL_IGNORED_CHARS_RE, "");
+    return DANGEROUS_SCHEME_RE.test(normalized);
+  }
+  function isEventHandlerAttr(name) {
+    return /^on/i.test(name);
+  }
+
   // src/runtime.ts
+  function isUnsafeAttrBinding(name, value2) {
+    if (isEventHandlerAttr(name)) return true;
+    if (isUrlAttr(name) && isDangerousUrl(value2)) return true;
+    return false;
+  }
   var _refetchRegistry = /* @__PURE__ */ new Map();
   function $refetch(id) {
     const fn = _refetchRegistry.get(id);
@@ -2012,7 +2088,12 @@ var FormaRuntime = (function (exports) {
         if (attr.value.includes("{item")) {
           const compiled = compileTemplate(attr.value);
           entries.push({ attr: attr.name, compiled });
-          node.setAttribute(attr.name, evaluateCompiledTemplate(compiled, item));
+          const value2 = evaluateCompiledTemplate(compiled, item);
+          if (isUnsafeAttrBinding(attr.name, value2)) {
+            node.removeAttribute(attr.name);
+          } else {
+            node.setAttribute(attr.name, value2);
+          }
         }
       }
       if (entries.length > 0) {
@@ -2784,7 +2865,12 @@ var FormaRuntime = (function (exports) {
           if (val == null || val === false) {
             el.removeAttribute(attrName);
           } else {
-            el.setAttribute(attrName, String(val));
+            const str = String(val);
+            if (isUnsafeAttrBinding(attrName, str)) {
+              el.removeAttribute(attrName);
+            } else {
+              el.setAttribute(attrName, str);
+            }
           }
         });
         disposers.push(dispose);