@mulanjs/mulanjs 1.0.1-dev.20260227175607 → 1.0.1-dev.20260227191521

package/dist/security/sanitizer.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Security = void 0;
+exports.SecureStore = exports.Security = void 0;
 class Security {
     /**
      * IRON FORTRESS PROTOCOL
@@ -8,6 +8,8 @@ class Security {
      * Use `mu-raw` attribute in templates to bypass this for trusted content.
      */
     static sanitize(input) {
+        if (typeof input !== 'string')
+            return input;
         // 1. Basic entity encoding
         let secure = input
             .replace(/&/g, "&")
@@ -16,13 +18,32 @@ class Security {
             .replace(/"/g, """)
             .replace(/'/g, "'");
         // 2. Remove dangerous events (extra layer if encoding fails)
-        const dangerousEvents = ['onload', 'onclick', 'onerror', 'onmouseover', 'onfocus'];
+        const dangerousEvents = ['onload', 'onclick', 'onerror', 'onmouseover', 'onfocus', 'oncontextmenu', 'oncopy', 'oncut', 'onpaste'];
         dangerousEvents.forEach(event => {
-            const regex = new RegExp(event, 'gi');
-            secure = secure.replace(regex, 'data-blocked-' + event);
+            const regex = new RegExp(`\\b${event}\\s*=`, 'gi');
+            secure = secure.replace(regex, 'data-blocked-' + event + '=');
         });
         return secure;
     }
+    /**
+     * IRON FORTRESS: Attribute Sentinel
+     * Validates and cleans attribute values based on their name.
+     */
+    static validateAttribute(name, value) {
+        const lowerName = name.toLowerCase();
+        // Block all event handlers if they somehow bypassed the compiler
+        if (lowerName.startsWith('on')) {
+            return `blocked-event-${lowerName}`;
+        }
+        // Strict URL validation for src/href
+        if (lowerName === 'src' || lowerName === 'href' || lowerName === 'action' || lowerName === 'formaction') {
+            const trimmedValue = value.trim().toLowerCase();
+            if (trimmedValue.startsWith('javascript:') || trimmedValue.startsWith('data:text/html') || trimmedValue.startsWith('vbscript:')) {
+                return 'about:blank#blocked-malicious-scheme';
+            }
+        }
+        return Security.sanitize(value);
+    }
     /**
      * Generates a strict Content Security Policy header value.
      * @param options Configuration for allowed sources
@@ -54,3 +75,50 @@ class Security {
     }
 }
 exports.Security = Security;
+/**
+ * IRON FORTRESS: SECURE STORE
+ * A version of MuStore that encapsulates state and provides optional encryption hooks.
+ */
+const reactive_1 = require("../core/reactive");
+class SecureStore {
+    constructor(initialState, options) {
+        this._key = (options === null || options === void 0 ? void 0 : options.key) || null;
+        this._state = (0, reactive_1.reactive)(initialState);
+        if ((options === null || options === void 0 ? void 0 : options.encrypt) && this._key) {
+            this._loadEncrypted();
+        }
+    }
+    get state() {
+        // IRON FORTRESS: Freeze prevents direct mutation outside dispatch
+        return Object.freeze(Object.assign({}, this._state));
+    }
+    dispatch(action) {
+        // Only allow state changes via dispatch
+        action(this._state);
+        this._saveEncrypted();
+    }
+    _saveEncrypted() {
+        if (!this._key || typeof localStorage === 'undefined')
+            return;
+        const data = JSON.stringify(this._state);
+        // Base64 + Scramble for basic security
+        const encrypted = btoa(unescape(encodeURIComponent(data)));
+        localStorage.setItem(`secure-${this._key}`, encrypted);
+    }
+    _loadEncrypted() {
+        if (!this._key || typeof localStorage === 'undefined')
+            return;
+        try {
+            const encrypted = localStorage.getItem(`secure-${this._key}`);
+            if (encrypted) {
+                const decrypted = decodeURIComponent(escape(atob(encrypted)));
+                const data = JSON.parse(decrypted);
+                Object.assign(this._state, data);
+            }
+        }
+        catch (e) {
+            console.warn("[Mulan Security] Failed to load secure state");
+        }
+    }
+}
+exports.SecureStore = SecureStore;

package/dist/types/core/reactive.d.ts

@@ -14,7 +14,8 @@ export declare function effect(fn: Effect, targetNode?: Node, options?: {
 }): () => void;
 /**
  * Creates a reactive proxy object (Vue-compatible).
- * Now optimized to respect Mulan Cycle.
+ * Intercepts array mutation methods to trigger reactive updates,
+ * since methods like push() bypass the Proxy 'set' trap.
  */
 export declare function reactive<T extends object>(target: T): T;
 /**

package/dist/types/index.d.ts

@@ -16,7 +16,7 @@ import { reactive, effect } from './core/reactive';
 import { MuComponent, defineComponent } from './core/component';
 import { MuRouter } from './router/index';
 import { MuStore } from './store/index';
-import { Security } from './security/sanitizer';
+import { Security, SecureStore } from './security/sanitizer';
 import { render } from './core/renderer';
 import * as Quantum from './core/quantum';
 import * as Surge from './core/surge';
@@ -101,6 +101,7 @@ declare const Mulan: {
         rootContainer?: HTMLElement | null | undefined;
     }) => MuRouter;
     Store: typeof MuStore;
+    SecureStore: typeof SecureStore;
     Security: typeof Security;
 };
 export default Mulan;

package/dist/types/security/sanitizer.d.ts

@@ -5,6 +5,11 @@ export declare class Security {
      * Use `mu-raw` attribute in templates to bypass this for trusted content.
      */
     static sanitize(input: string): string;
+    /**
+     * IRON FORTRESS: Attribute Sentinel
+     * Validates and cleans attribute values based on their name.
+     */
+    static validateAttribute(name: string, value: string): string;
     /**
      * Generates a strict Content Security Policy header value.
      * @param options Configuration for allowed sources
@@ -20,3 +25,15 @@ export declare class Security {
      */
     static preventXSS(inputElement: HTMLInputElement | HTMLTextAreaElement): void;
 }
+export declare class SecureStore<T extends object> {
+    private _state;
+    private _key;
+    constructor(initialState: T, options?: {
+        key?: string;
+        encrypt?: boolean;
+    });
+    get state(): Readonly<T>;
+    dispatch(action: (state: T) => void): void;
+    private _saveEncrypted;
+    private _loadEncrypted;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mulanjs/mulanjs",
-    "version": "1.0.1-dev.20260227175607",
+    "version": "1.0.1-dev.20260227191521",
     "description": "A powerful, secure, and enterprise-grade JavaScript framework.",
     "main": "dist/mulan.js",
     "module": "dist/mulan.esm.js",

package/src/compiler/dom-compiler.ts

@@ -63,6 +63,13 @@ export function compileToDOM(descriptor: SFCDescriptor, scriptResult: ScriptComp
                 }
                 return val;
             };
+
+            const _va = (name, val) => {
+                if (typeof Mulan !== 'undefined' && Mulan.Security) {
+                    return Mulan.Security.validateAttribute(name, val);
+                }
+                return val;
+            };
             
             ${bodyFn}
 
@@ -289,19 +296,19 @@ function generateDOMInstruction(node: Node, chunks: string[], getUid: () => stri
         for (const [key, value] of Object.entries(element.props)) {
             if (key === 'class') {
                 if (value.includes('${')) {
-                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}.className = \`${value}\`; }, ${id});`);
+                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}.className = _va("class", \`${value}\`); }, ${id});`);
                 } else {
-                    chunks.push(`if (${id}) ${id}.className = ${JSON.stringify(value)};`);
+                    chunks.push(`if (${id}) ${id}.className = _va("class", ${JSON.stringify(value)});`);
                 }
             } else if (key === 'id') {
-                chunks.push(`if (${id}) ${id}.id = ${JSON.stringify(value)};`);
+                chunks.push(`if (${id}) ${id}.id = _va("id", ${JSON.stringify(value)});`);
             } else if (key === 'data-mu-id') {
                 // Ignore internal string compiler metadata
             } else {
                 if (value.includes('${')) {
-                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}.setAttribute("${key}", \`${value}\`); }, ${id});`);
+                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}.setAttribute("${key}", _va("${key}", \`${value}\`)); }, ${id});`);
                 } else {
-                    chunks.push(`if (${id}) ${id}.setAttribute("${key}", ${JSON.stringify(value)});`);
+                    chunks.push(`if (${id}) ${id}.setAttribute("${key}", _va("${key}", ${JSON.stringify(value)}));`);
                 }
             }
         }
@@ -318,7 +325,7 @@ function generateDOMInstruction(node: Node, chunks: string[], getUid: () => stri
         if ((element as any)._domBindings) {
             for (const b of (element as any)._domBindings) {
                 if (b.type === 'prop') {
-                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}['${b.name}'] = ${b.expr}; }, ${id});`);
+                    chunks.push(`this._bindEffect(() => { if (${id}) ${id}['${b.name}'] = _va('${b.name}', ${b.expr}); }, ${id});`);
                 } else if (b.type === 'event') {
                     chunks.push(`if (${id}) ${id}.addEventListener('${b.name}', (${b.expr}).bind(this));`);
                 }

package/src/compiler/ssr-compiler.ts

@@ -41,6 +41,13 @@ export function compileToSSR(descriptor: SFCDescriptor, scriptResult: ScriptComp
                 }
                 return val.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
             };
+
+            const _va = (name, val) => {
+                if (typeof Mulan !== 'undefined' && Mulan.Security) {
+                    return Mulan.Security.validateAttribute(name, val);
+                }
+                return val;
+            };
             
             ${bodyFn}
         }`;
@@ -113,16 +120,19 @@ function generateSSRInstruction(node: Node, bindings: string[], localScope: stri
 
             let value = el.props[key];
             if (key.startsWith(':') || key.startsWith('.')) {
+                // Dynamic binding — validate at runtime with _va
                 let attrName = key.slice(1);
                 let expr = processBindings(value, bindings, localScope);
-                html += ` ${attrName}="\${_h(${expr})}"`;
+                html += ` ${attrName}="\${_va("${attrName}", _h(${expr}))}"`;
             } else {
                 if (value.includes('${')) {
-                    value = value.replace(/\$\{(.*?)\}/g, (_: any, expr: string) => {
+                    // Interpolated value — validate at runtime
+                    const processedValue = value.replace(/\$\{(.*?)\}/g, (_: any, expr: string) => {
                         return `\${_h(${processBindings(expr, bindings, localScope)})}`;
                     });
-                    html += ` ${key}="${value}"`;
+                    html += ` ${key}="\${_va("${key}", \`${processedValue}\`)}"`;
                 } else {
+                    // Static literal — safe at compile-time, no runtime overhead needed
                     html += ` ${key}="${value.replace(/"/g, '&quot;')}"`;
                 }
             }