@zyrab/domo 1.2.1 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyrab/domo",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Minimalist DOM builder and chaining-friendly micro-framework with router support.",
   "main": "./src/domo.js",
   "type": "module",

package/src/builder.js

@@ -32,9 +32,12 @@ class Builder {
 
     if (cls) attrs.push(`class="${cls}"`);
     if (css) attrs.push(`style="${css}"`);
+    const escapeHTML = (str) => String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 
     const attrStr = attrs.concat(data).join(" ");
-    const children = this.element._child.map((c) => (typeof c === "string" ? c : c.build?.() || "")).join("");
+    const children = this.element._child
+      .map((c) => (typeof c === "string" ? escapeHTML(c) : c.build?.() || ""))
+      .join("");
 
     return `<${tag}${attrStr ? " " + attrStr : ""}>${children}</${tag}>`;
   }

package/src/children.js

@@ -10,10 +10,6 @@ class Children {
    * a string for virtual children, or a Domo instance for virtual children.
    */
   _handleElementInstance(element) {
-    // Check if Domo class exists (it's imported in main.domo.js for final class)
-    // To avoid circular dependency in JSDoc parsing, we'll check runtime type.
-    // For JSDoc type checking, we assume Domo is available in the context of main.domo.js.
-    // @ts-ignore - Ignore potential 'Domo is not defined' for JSDoc tool
     if (element instanceof DomoClass) return element.build();
 
     if (element instanceof DocumentFragment) return element;