sibujs 4.7.0 → 4.8.0

package/dist/{chunk-UOL2ECCS.js → chunk-VWT3VXPL.js}

@@ -1,15 +1,18 @@
 import {
   bindAttribute,
   setSafeAttribute
-} from "./chunk-FNJXNGYZ.js";
+} from "./chunk-O6TRVMJI.js";
+import {
+  isBlockedElement
+} from "./chunk-3ACAAQIN.js";
 import {
   isEventHandlerAttr,
-  sanitizeCSSValue,
+  sanitizeCSSDeclaration,
   sanitizeStyleAttribute
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-EXXSN3BW.js";
 import {
   reactiveBinding
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   DEV,
   devWarn,
@@ -189,10 +192,6 @@ function bindChildNode(placeholder, getter) {
 
 // src/core/rendering/tagFactory.ts
 var SVG_NS = "http://www.w3.org/2000/svg";
-var BLOCKED_TAGS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
-function isBlockedTag(tag) {
-  return BLOCKED_TAGS.has(tag.toLowerCase());
-}
 var CLOBBER_RISKY_IDS = /* @__PURE__ */ new Set([
   "config",
   "location",
@@ -237,11 +236,12 @@ function applyStyle(el, style) {
       }
       const next = [];
       for (const prop in value) {
+        if (!Object.hasOwn(value, prop)) continue;
         const val = value[prop];
         if (val == null) continue;
         const name = toKebab(prop);
         next.push(name);
-        decl.setProperty(name, sanitizeCSSValue(String(val), { property: name, element: el }));
+        decl.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
       }
       for (let i = 0; i < written.length; i++) {
         if (next.indexOf(written[i]) === -1) decl.removeProperty(written[i]);
@@ -257,16 +257,17 @@ function applyStyle(el, style) {
   }
   const htmlEl = el;
   for (const prop in style) {
+    if (!Object.hasOwn(style, prop)) continue;
     const val = style[prop];
     const name = toKebab(prop);
     if (typeof val === "function") {
       const getter = val;
       const teardown = reactiveBinding(() => {
-        htmlEl.style.setProperty(name, sanitizeCSSValue(String(getter()), { property: name, element: el }));
+        htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(getter()), { element: el }));
       }, el);
       registerDisposer(el, teardown);
     } else {
-      htmlEl.style.setProperty(name, sanitizeCSSValue(String(val), { property: name, element: el }));
+      htmlEl.style.setProperty(name, sanitizeCSSDeclaration(name, String(val), { element: el }));
     }
   }
 }
@@ -276,6 +277,7 @@ function resolveClassValue(cls) {
   if (!cls) return "";
   let out = "";
   for (const name in cls) {
+    if (!Object.hasOwn(cls, name)) continue;
     const val = cls[name];
     const active = typeof val === "function" ? val() : val;
     if (active) out = out ? `${out} ${name}` : name;
@@ -300,6 +302,7 @@ function applyClass(el, cls) {
   let hasReactive = false;
   let result = "";
   for (const name in obj) {
+    if (!Object.hasOwn(obj, name)) continue;
     const val = obj[name];
     if (typeof val === "function") {
       hasReactive = true;
@@ -311,6 +314,7 @@ function applyClass(el, cls) {
     const update = () => {
       let r = "";
       for (const name in obj) {
+        if (!Object.hasOwn(obj, name)) continue;
         const val = obj[name];
         const active = typeof val === "function" ? val() : val;
         if (active) r = r ? `${r} ${name}` : name;
@@ -374,7 +378,7 @@ function appendChildren(el, nodes) {
   }
 }
 function tagFactory(tag, ns) {
-  const blocked = isBlockedTag(tag);
+  const blocked = isBlockedElement(tag);
   return (first, second) => {
     if (blocked) {
       throw new Error(`tagFactory: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
@@ -437,6 +441,7 @@ function tagFactory(tag, ns) {
     const pOn = props.on;
     if (pOn) {
       for (const ev in pOn) {
+        if (!Object.hasOwn(pOn, ev)) continue;
         const handler = pOn[ev];
         if (typeof handler === "function") {
           el.addEventListener(ev, handler);
@@ -463,6 +468,7 @@ function tagFactory(tag, ns) {
           continue;
         // already handled above / below
         default: {
+          if (!Object.hasOwn(props, key)) continue;
           const value = props[key];
           if (value == null) continue;
           if (isEventHandlerAttr(key)) continue;

package/dist/{chunk-2BPG2XDA.js → chunk-ZVLHNEEL.js}

@@ -1,29 +1,33 @@
 import {
   domBinding
-} from "./chunk-BC2SECJD.js";
+} from "./chunk-C7AA2CZX.js";
 import {
   bindAttribute,
   setSafeAttribute
-} from "./chunk-FNJXNGYZ.js";
+} from "./chunk-O6TRVMJI.js";
 import {
-  derived
-} from "./chunk-RUSSKG6G.js";
+  isBlockedElement
+} from "./chunk-3ACAAQIN.js";
 import {
-  isEventHandlerAttr
-} from "./chunk-2INLLLMZ.js";
+  derived
+} from "./chunk-KJ3UKABJ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
+import {
+  isEventHandlerAttr,
+  sanitizeStylesheetText
+} from "./chunk-EXXSN3BW.js";
 import {
   adoptThenable
 } from "./chunk-5HZXGZ6T.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   reactiveBinding,
   track
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   dispose,
   disposeNodeOwn,
@@ -745,31 +749,6 @@ function announce(message, priority = "polite") {
 
 // src/ui/scopedStyle.ts
 var _scope = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.scopedStyle.v1"), () => ({ n: 0 }));
-function decodeCssEscapes(css) {
-  return css.replace(/\\([0-9a-f]{1,6})[ \t\n\r\f]?|\\([^\n])/gi, (_match, hex, ch) => {
-    if (hex) {
-      const code = Number.parseInt(hex, 16);
-      if (Number.isFinite(code) && code > 0 && code <= 1114111) {
-        try {
-          return String.fromCodePoint(code);
-        } catch {
-          return "";
-        }
-      }
-      return "";
-    }
-    return ch || "";
-  });
-}
-function sanitizeCSS(css) {
-  let sanitized = decodeCssEscapes(css);
-  sanitized = sanitized.replace(/@import\s+[^;]+;/gi, "/* @import removed */");
-  sanitized = sanitized.replace(/url\s*\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\s*\)/gi, "/* url() removed */");
-  sanitized = sanitized.replace(/expression\s*\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\s*\)/gi, "/* expression() removed */");
-  sanitized = sanitized.replace(/-moz-binding\s*:[^;]+;/gi, "/* -moz-binding removed */");
-  sanitized = sanitized.replace(/behavior\s*:[^;]+;/gi, "/* behavior removed */");
-  return sanitized;
-}
 function firstCompoundEnd(selector) {
   let parens = 0;
   let brackets = 0;
@@ -931,7 +910,7 @@ function scopeStylesheet(css, attr) {
 function scopedStyle(css) {
   const id = `sibu-s${_scope.n++}`;
   const attr = `data-${id}`;
-  const safeCss = sanitizeCSS(css);
+  const safeCss = sanitizeStylesheetText(css);
   const scopedCSS = scopeStylesheet(safeCss, attr);
   if (typeof document !== "undefined") {
     const styleEl = document.createElement("style");
@@ -989,7 +968,7 @@ function bindBoolAttr(el, attr, getter) {
       reportError(err, { phase: "binding", name: "bindBoolAttr", node: el });
       return;
     }
-    setSafeAttribute(el, attr, Boolean(value), { label: "bindBoolAttr" });
+    setSafeAttribute(el, attr, Boolean(value), { label: "bindBoolAttr", reactive: true });
   }
   return reactiveBinding(commit, el);
 }
@@ -1472,6 +1451,9 @@ function defineElement(name, component, options = {}) {
   customElements.define(name, SibuElement);
 }
 function svgElement(tag, props = {}, ...nodes) {
+  if (isBlockedElement(tag)) {
+    throw new Error(`svgElement: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+  }
   const el = document.createElementNS(SVG_NS, tag);
   for (const [key, value] of Object.entries(props)) {
     if (key === "nodes") continue;

package/dist/{customElement-MmInOW1U.d.ts → customElement-pYDKUzWl.d.cts}

@@ -277,9 +277,11 @@ declare function announce(message: string, priority?: "polite" | "assertive"): v
  * and prefixing all selectors.
  * Returns the scope attribute name and injects the CSS into the document.
  *
- * CSS is sanitized to remove dangerous patterns (`url()`, `@import`,
- * `expression()`, `-moz-binding`, `behavior`). If you need `url()` for
- * background images, use inline styles via the `style` prop instead.
+ * CSS is sanitized by the framework's stylesheet-text policy
+ * (`sanitizeStylesheetText`): `url()`, `image-set()`, `image()`, `src()`,
+ * `expression()`, `@import`, `behavior`, `-moz-binding` and `progid:` filters
+ * are removed. For a content image use an `<img>`; for a decorative one, a
+ * stylesheet you ship.
  */
 declare function scopedStyle(css: string): {
     scope: string;
@@ -484,6 +486,7 @@ declare function eventBus<T extends object>(): {
 interface CustomElementOptions {
     shadow?: boolean;
     mode?: "open" | "closed";
+    /** Stylesheet source for the element's shadow root, applied unsanitized — developer CSS, not runtime data. */
     styles?: string;
     observedAttributes?: string[];
 }
@@ -504,6 +507,11 @@ declare function defineElement(name: string, component: (props: Record<string, u
  *
  * Function-valued `on*` props keep their existing meaning — `addEventListener`,
  * never an attribute.
+ *
+ * The TAG is policed like a tag factory's, through the shared element policy:
+ * `svgElement("script", { href })` is refused. SVG has its own `<script>`, which
+ * the browser fetches and runs when it is inserted, so an unrestricted tag name
+ * here was a way around the tag factories' block on script elements.
  */
 declare function svgElement(tag: string, props?: Record<string, unknown>, ...nodes: (SVGElement | string)[]): SVGElement;
 

package/dist/{customElement-MmInOW1U.d.cts → customElement-pYDKUzWl.d.ts}

@@ -277,9 +277,11 @@ declare function announce(message: string, priority?: "polite" | "assertive"): v
  * and prefixing all selectors.
  * Returns the scope attribute name and injects the CSS into the document.
  *
- * CSS is sanitized to remove dangerous patterns (`url()`, `@import`,
- * `expression()`, `-moz-binding`, `behavior`). If you need `url()` for
- * background images, use inline styles via the `style` prop instead.
+ * CSS is sanitized by the framework's stylesheet-text policy
+ * (`sanitizeStylesheetText`): `url()`, `image-set()`, `image()`, `src()`,
+ * `expression()`, `@import`, `behavior`, `-moz-binding` and `progid:` filters
+ * are removed. For a content image use an `<img>`; for a decorative one, a
+ * stylesheet you ship.
  */
 declare function scopedStyle(css: string): {
     scope: string;
@@ -484,6 +486,7 @@ declare function eventBus<T extends object>(): {
 interface CustomElementOptions {
     shadow?: boolean;
     mode?: "open" | "closed";
+    /** Stylesheet source for the element's shadow root, applied unsanitized — developer CSS, not runtime data. */
     styles?: string;
     observedAttributes?: string[];
 }
@@ -504,6 +507,11 @@ declare function defineElement(name: string, component: (props: Record<string, u
  *
  * Function-valued `on*` props keep their existing meaning — `addEventListener`,
  * never an attribute.
+ *
+ * The TAG is policed like a tag factory's, through the shared element policy:
+ * `svgElement("script", { href })` is refused. SVG has its own `<script>`, which
+ * the browser fetches and runs when it is inserted, so an unrestricted tag name
+ * here was a way around the tag factories' block on script elements.
  */
 declare function svgElement(tag: string, props?: Record<string, unknown>, ...nodes: (SVGElement | string)[]): SVGElement;
 

package/dist/data.cjs

@@ -660,7 +660,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1289,7 +1289,11 @@ function reconcile(prev, next, depth, walk, newRoot) {
     const nextChild = nextRecord[key];
     const hasPrev = Object.hasOwn(prevRecord, key);
     const shared = hasPrev ? reconcile(prevRecord[key], nextChild, depth + 1, walk, false) : nextChild;
-    copy[key] = shared;
+    if (key === "__proto__") {
+      Object.defineProperty(copy, key, { value: shared, writable: true, enumerable: true, configurable: true });
+    } else {
+      copy[key] = shared;
+    }
     if (!hasPrev || !Object.is(shared, prevRecord[key])) allFromPrev = false;
     if (!Object.is(shared, nextChild)) allFromNext = false;
   }
@@ -2660,6 +2664,9 @@ function sanitizeUrl(url) {
   const probe = stripControlChars(url).trim();
   if (!probe) return "";
   const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
   const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i = 0; i < lower.length; i++) {

package/dist/data.js

@@ -22,14 +22,14 @@ import {
   throttle,
   withLoader,
   withRetry
-} from "./chunk-WOLJZUFQ.js";
-import "./chunk-RUSSKG6G.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-UCNP3HVM.js";
+import "./chunk-KJ3UKABJ.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   __resetQueryCache,

package/dist/devtools.cjs

@@ -844,7 +844,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;

package/dist/devtools.js

@@ -35,13 +35,13 @@ import {
   trackCleanup,
   walkDependencyGraph,
   withErrorTracking
-} from "./chunk-DKXRACVN.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-44MTL7ED.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import {
   isDev
 } from "./chunk-NYNYSPK7.js";