@wiajs/core 1.1.33 → 1.2.1

package/dist/core.cjs

@@ -1,5 +1,5 @@
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */

package/dist/core.js

@@ -1,5 +1,5 @@
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */

package/dist/core.min.js

@@ -1,10 +1,10 @@
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */

package/dist/core.mjs

@@ -1,5 +1,5 @@
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */

package/dist/jsx-runtime.js

@@ -1,5 +1,5 @@
 /*!
-  * wia core v1.1.33
+  * wia core v1.2.1
   * (c) 2015-2025 Sibyl Yu and contributors
   * Released under the MIT License.
   */
@@ -10,6 +10,15 @@ Object.defineProperty(exports, '__esModule', { value: true });
 var jsxRuntime = {};
 
 // runtime: 'automatic', // automatic or classic automatic 使用 JSX 运行时（在React 17 中引入）
+// HTML 属性值转义函数
+function escapeAttrValue(value) {
+  return String(value)
+    .replace(/&/g, "&")
+    .replace(/"/g, """)
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
 function jsx(tag, {children, ...props} = {}) {
   let R = '';
 
@@ -20,12 +29,12 @@ function jsx(tag, {children, ...props} = {}) {
 
     // 特殊处理 className 和 htmlFor
     if (attrs.className) {
-      attrsArray.push(`class="${attrs.className}"`);
+      attrsArray.push(`class="${escapeAttrValue(attrs.className)}"`);
       delete attrs.className;
     }
     
     if (attrs.htmlFor) {
-      attrsArray.push(`for="${attrs.htmlFor}"`);
+      attrsArray.push(`for="${escapeAttrValue(attrs.htmlFor)}"`);
       delete attrs.htmlFor;
     }
 
@@ -48,7 +57,7 @@ function jsx(tag, {children, ...props} = {}) {
         
         styleArray.push(`${cssProp}:${cssValue}`);
       }
-      attrsArray.push(`style="${styleArray.join(';')}"`);
+      attrsArray.push(`style="${escapeAttrValue(styleArray.join(';'))}"`);
       delete attrs.style;
     }
     
@@ -59,13 +68,11 @@ function jsx(tag, {children, ...props} = {}) {
       
       // 处理布尔属性（如 disabled, checked 等）
       if (typeof value === 'boolean') {
-        if (value) {
-          attrsArray.push(key);
-        }
+        if (value) attrsArray.push(key);        
       } 
       // 处理动态值属性
       else if (value != null) {
-        attrsArray.push(`${key}="${value}"`);
+        attrsArray.push(`${key}="${escapeAttrValue(value)}"`);
       }
     }
 
@@ -85,7 +92,7 @@ function jsx(tag, {children, ...props} = {}) {
     // 自闭合标签处理
     const voidElements = ['input', 'img', 'br', 'hr', 'meta', 'link', 'area', 'base', 'col', 'embed', 'param', 'source', 'track', 'wbr', 'path', 'circle', 'polygon', 'line', 'rect', 'ellipse', 'use', 'stop'];
     if (voidElements.includes(tag))
-      R = `<${tag} ${attrsString} />`.trim();
+      R = `<${tag}${attrsString ? ' ' + attrsString : ''} />`;
     else {
       const childrenContent = Array.isArray(children)
         ? children
@@ -103,7 +110,7 @@ function jsx(tag, {children, ...props} = {}) {
           ? (typeof children === 'boolean' ? '' : children)
           : '';
 
-      R = `<${tag} ${attrsString}>${childrenContent}</${tag}>`.trim();
+      R = `<${tag}${attrsString ? ' ' + attrsString : ''}>${childrenContent}</${tag}>`;
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wiajs/core",
-  "version": "1.1.33",
+  "version": "1.2.1",
   "description": "wia app core package",
   "main": "./dist/core.cjs",
   "module": "./dist/core.mjs",