@magneticjs/server 0.1.2 → 0.1.4

package/package.json

@@ -1,17 +1,15 @@
 {
   "name": "@magneticjs/server",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Magnetic server-driven UI framework — JSX runtime, router, SSR",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
     "./jsx-runtime": "./src/jsx-runtime.ts",
     "./router": "./src/router.ts",
-    "./ssr": "./src/ssr.ts",
-    "./transport.wasm": "./wasm/transport.wasm",
-    "./magnetic.js": "./wasm/magnetic.js"
+    "./ssr": "./src/ssr.ts"
   },
-  "files": ["src", "wasm"],
+  "files": ["src"],
   "publishConfig": {
     "access": "public"
   },

package/src/jsx-runtime.ts

@@ -26,9 +26,11 @@ type Component = (props: any) => DomNode;
  * Client-side navigation link. Renders an <a> that magnetic.js intercepts
  * to do pushState + send navigate action (no full page reload).
  */
-export function Link(props: { href: string; children?: Child | Child[]; class?: string; [k: string]: unknown }): DomNode {
-  const { href, children, ...rest } = props;
-  return jsx('a', { ...rest, href, onClick: `navigate:${href}`, children }, undefined);
+export function Link(props: { href: string; prefetch?: boolean; children?: Child | Child[]; class?: string; [k: string]: unknown }): DomNode {
+  const { href, prefetch, children, ...rest } = props;
+  const extra: Record<string, unknown> = { ...rest, href, onClick: `navigate:${href}` };
+  if (prefetch) extra['data-prefetch'] = href;
+  return jsx('a', { ...extra, children }, undefined);
 }
 
 /**
@@ -44,6 +46,9 @@ export function Head({ children }: { children?: Child | Child[] }): DomNode {
   return { tag: 'magnetic:head', children: flat };
 }
 
+// URI attributes to sanitize against javascript: injection
+const URI_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'xlink:href']);
+
 // Event prop prefix → event name mapping
 const EVENT_MAP: Record<string, string> = {
   onClick: 'click',
@@ -109,7 +114,11 @@ export function jsx(tag: string | Component, props: Props, key?: string | number
       continue;
     }
 
-    attrs[k] = String(v);
+    // Sanitize URI attributes — defense in depth against javascript: injection
+    const sv = String(v);
+    if (URI_ATTRS.has(k) && /^\s*javascript\s*:/i.test(sv)) continue;
+
+    attrs[k] = sv;
   }
 
   if (Object.keys(attrs).length) node.attrs = attrs;

package/wasm/magnetic.js

@@ -1 +0,0 @@
-(function(d) {var M = self.Magnetic = {};var root = null;var es = null;var wasm = null;var status = "disconnected";var queue = [];var keys = {};var deb = {};var lastHash = "";var enc = new TextEncoder();M.status = function() { return status; };M.connect = function(url, mount) {root = typeof mount == "string" ? d.querySelector(mount) : mount;es = new EventSource(url);es.onmessage = function(ev) {try {var raw = ev.data;if (wasm && wasm.store) {var bytes = enc.encode(raw);if (bytes.length <= 16384) {new Uint8Array(wasm.memory.buffer).set(bytes, wasm.input_ptr());if (wasm.store(bytes.length) === 0) return;}} else {var h = fnv(raw);if (h === lastHash) return;lastHash = h;}apply(JSON.parse(raw));} catch(e) { console.error("[magnetic] SSE error:", e); }};es.onerror = function() {if (wasm) status = "offline";};status = "connected";bind();};M.disconnect = function() {if (es) { es.close(); es = null; }status = "disconnected";};function apply(snap) {if (!root || !snap || !snap.root) return;var n = snap.root;if (n.key && keys[n.key] && keys[n.key].parentNode === root) {patch(keys[n.key], n);return;}root.textContent = "";root.appendChild(create(n));}M._apply = apply;function create(n) {var el = d.createElement(n.tag);if (n.key) { el.dataset.key = n.key; keys[n.key] = el; }setAttrs(el, n);if (n.events) for (var v in n.events) el.dataset["a_" + v] = n.events[v];if (n.text != null) el.textContent = n.text;if (n.children) for (var i = 0; i < n.children.length; i++) el.appendChild(create(n.children[i]));return el;}function patch(el, n) {setAttrs(el, n);if (n.events) {for (var v in n.events) el.dataset["a_" + v] = n.events[v];}var da = el.dataset;for (var dk in da) {if (dk.indexOf("a_") === 0) {var ev = dk.slice(2);if (!n.events || !(ev in n.events)) delete da[dk];}}if (n.children) {reconcile(el, n.children);} else if (n.text != null && n.tag != "input" && n.tag != "textarea") {el.textContent = n.text;} else if (!n.children && n.text == null && n.tag != "input" && n.tag != "textarea") {while (el.firstChild) {purgeKeys(el.firstChild);el.removeChild(el.firstChild);}}}function purgeKeys(el) {var k = el.dataset ? el.dataset.key : null;if (k) delete keys[k];var ch = el.firstChild;while (ch) { purgeKeys(ch); ch = ch.nextSibling; }}function reconcile(parent, descs) {var i, c, el, k;var newEls = [];var wantKeys = {};for (i = 0; i < descs.length; i++) {c = descs[i];if (c.key && keys[c.key]) {el = keys[c.key];patch(el, c);wantKeys[c.key] = true;} else {el = create(c);if (c.key) wantKeys[c.key] = true;}newEls.push(el);}var ch = parent.firstChild;while (ch) {var nx = ch.nextSibling;k = ch.dataset ? ch.dataset.key : null;if (!k || !wantKeys[k]) {purgeKeys(ch);parent.removeChild(ch);}ch = nx;}for (i = 0; i < newEls.length; i++) {if (parent.childNodes[i] !== newEls[i]) {parent.insertBefore(newEls[i], parent.childNodes[i] || null);}}}function setAttrs(el, n) {if (n.attrs) for (var k in n.attrs) el.setAttribute(k, n.attrs[k]);}function bind() {d.addEventListener("click", function(e) {var t = e.target.closest("[data-a_click]");if (t) { e.preventDefault(); send(t.dataset.a_click, {}); }});d.addEventListener("submit", function(e) {var t = e.target.closest("[data-a_submit]");if (t) {e.preventDefault();var p = {}, f = new FormData(t);f.forEach(function(v, k) { p[k] = v; });send(t.dataset.a_submit, p);t.querySelectorAll("input").forEach(function(i) { i.value = ""; });}});d.addEventListener("input", function(e) {var t = e.target.closest("[data-a_input]");if (t) {var a = t.dataset.a_input;clearTimeout(deb[a]);deb[a] = setTimeout(function() { send(a, { value: t.value }); }, 300);}});}M.send = send;function send(action, payload) {if (action.indexOf("navigate:") === 0) {var path = action.slice(9);history.pushState({}, "", path);action = "navigate";payload = { path: path };}var body = JSON.stringify({ action: action, payload: payload });fetch("/actions/" + encodeURIComponent(action), {method: "POST",headers: { "Content-Type": "application/json" },body: body}).then(function(r) { return r.text(); }).then(function(raw) {if (!raw || raw[0] !== "{") return;if (wasm && wasm.store) {var bytes = enc.encode(raw);if (bytes.length <= 16384) {new Uint8Array(wasm.memory.buffer).set(bytes, wasm.input_ptr());wasm.store(bytes.length);}} else {lastHash = fnv(raw);}try { apply(JSON.parse(raw)); } catch(e) {}}).catch(function() {});if (status != "connected") queue.push(body);}self.addEventListener("popstate", function() {send("navigate", { path: location.pathname + location.search });});M.loadWasm = function(url) {if (wasm !== null) return;wasm = 0;fetch(url).then(function(r) { return r.arrayBuffer(); }).then(function(b) { return WebAssembly.instantiate(b, {}); }).then(function(result) {wasm = result.instance.exports;while (queue.length) {var q = JSON.parse(queue.shift());send(q.action, q.payload);}}).catch(function() { wasm = null; });};function fnv(s) {var h = 0x811c9dc5;for (var i = 0; i < s.length; i++) {h ^= s.charCodeAt(i);h = Math.imul(h, 0x01000193);}return h;}})(document);