rasti 4.1.1-alpha.0 → 4.1.1

package/README.md

@@ -1,7 +1,7 @@
 <p align="center">
     <picture>
-        <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1-alpha.0/docs/logo-dark.svg">
-        <img alt="Rasti.js" src="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1-alpha.0/docs/logo.svg" height="120">
+        <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1/docs/logo-dark.svg">
+        <img alt="Rasti.js" src="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1/docs/logo.svg" height="120">
     </picture>
 </p>
 

package/dist/rasti.js

@@ -1711,12 +1711,15 @@
     }
 
     /**
-     * Characters that terminate an attribute name. A name containing any of them
-     * would let the rest of the value be parsed as markup instead of as a name.
+     * Match a name that is legal for an HTML attribute. Excludes whitespace, quotes,
+     * `>`, `/`, `=` and control characters, which would otherwise end the attribute
+     * or the tag when the name is interpolated into markup. An empty name is excluded
+     * as well, since it can't be serialized as a name.
      * @type {RegExp}
      * @private
      */
-    const INVALID_ATTRIBUTE_NAME = /[\s"'>/=]/;
+    // eslint-disable-next-line no-control-regex
+    const VALID_ATTRIBUTE_NAME = /^[^\s"'>/=\u0000-\u001F\u007F-\u009F]+$/;
 
     /**
      * Escape an attribute value. Values are serialized inside double quotes,
@@ -1740,7 +1743,7 @@
         Object.keys(attributes).forEach(key => {
             let value = attributes[key];
             // Skip invalid names, they can't be serialized as an attribute.
-            if (INVALID_ATTRIBUTE_NAME.test(key)) return;
+            if (!VALID_ATTRIBUTE_NAME.test(key)) return;
 
             if (value === true) {
                 html.push(key);