pulse-js-framework 1.11.2 → 1.11.4

package/runtime/utils.js

@@ -30,12 +30,13 @@ export { escapeHtml, sanitizeUrl };
  */
 export function unescapeHtml(str) {
   if (str == null) return '';
+  // Unescape &amp; LAST to avoid double-unescaping (e.g., '&amp;lt;' -> '&lt;' -> '<')
   return String(str)
-    .replace(/&amp;/g, '&')
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
     .replace(/&quot;/g, '"')
-    .replace(/&#39;/g, "'");
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
 }
 
 /**

package/server/utils.js

@@ -7,7 +7,7 @@
  * @module pulse-js-framework/server/utils
  */
 
-import { readFileSync, existsSync, statSync } from 'fs';
+import { readFileSync } from 'fs';
 import { extname, resolve, sep } from 'path';
 
 // ============================================================================
@@ -104,11 +104,15 @@ export function readTemplate(templatePath) {
     return templateCache.get(templatePath);
   }
 
-  if (!existsSync(templatePath)) {
-    throw new Error(`[Pulse Server] Template not found: ${templatePath}`);
+  let content;
+  try {
+    content = readFileSync(templatePath, 'utf-8');
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      throw new Error(`[Pulse Server] Template not found: ${templatePath}`);
+    }
+    throw e;
   }
-
-  const content = readFileSync(templatePath, 'utf-8');
   templateCache.set(templatePath, content);
   return content;
 }
@@ -155,11 +159,13 @@ export function resolveStaticAsset(pathname, distDir, options = {}) {
     return null;
   }
 
-  if (!existsSync(filePath) || !statSync(filePath).isFile()) {
-    return null;
+  let content;
+  try {
+    content = readFileSync(filePath);
+  } catch (err) {
+    if (err.code === 'ENOENT' || err.code === 'EISDIR') return null;
+    throw err;
   }
-
-  const content = readFileSync(filePath);
   const mimeType = getMimeType(filePath);
 
   // Hashed assets get long cache

package/sw/index.js

@@ -224,6 +224,8 @@ export function createCacheStrategy(name, options = {}) {
  */
 export function enableSkipWaiting() {
   self.addEventListener('message', (event) => {
+    // Validate origin: only accept messages from the same origin as the service worker
+    if (event.origin && event.origin !== self.location.origin) return;
     if (event.data?.type === 'SKIP_WAITING') {
       self.skipWaiting();
     }