sibujs 4.7.0 → 4.8.0

package/dist/chunk-3ACAAQIN.js

@@ -0,0 +1,224 @@
+import {
+  canonicalAttrName,
+  isEventHandlerAttr,
+  isHtmlContentAttribute,
+  isUrlAttribute,
+  sanitizeUrl,
+  stripControlChars
+} from "./chunk-EXXSN3BW.js";
+import {
+  DEV
+} from "./chunk-NYNYSPK7.js";
+
+// src/utils/metaRefresh.ts
+function isAsciiWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
+function trimAsciiWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isAsciiWhitespace(value[start])) start++;
+  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
+  return value.slice(start, end);
+}
+var forbidden = (reason) => ({ kind: "forbidden", reason });
+function parseMetaRefreshContent(content) {
+  const raw = trimAsciiWhitespace(stripControlChars(content));
+  if (raw === "") return forbidden(DEV ? "empty content" : "");
+  let i = 0;
+  while (i < raw.length && raw[i] >= "0" && raw[i] <= "9") i++;
+  if (i === 0) return forbidden(DEV ? "missing or non-numeric delay" : "");
+  const delay = Number.parseInt(raw.slice(0, i), 10);
+  if (!Number.isFinite(delay)) return forbidden(DEV ? "unparseable delay" : "");
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (i === raw.length) return { kind: "delay-only", delay };
+  if (raw[i] !== ";" && raw[i] !== ",") return forbidden(DEV ? "unexpected text after delay" : "");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  const keyStart = i;
+  while (i < raw.length && !isAsciiWhitespace(raw[i]) && raw[i] !== "=") i++;
+  const key = raw.slice(keyStart, i).toLowerCase();
+  if (key !== "url") return forbidden(DEV ? `unsupported refresh key ${JSON.stringify(key)}` : "");
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  if (raw[i] !== "=") return forbidden(DEV ? "missing '=' after url" : "");
+  i++;
+  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
+  let destination;
+  const quote = raw[i];
+  if (quote === '"' || quote === "'") {
+    const close = raw.indexOf(quote, i + 1);
+    if (close === -1) return forbidden(DEV ? "unterminated quoted destination" : "");
+    destination = raw.slice(i + 1, close);
+    const rest = trimAsciiWhitespace(raw.slice(close + 1));
+    if (rest !== "") return forbidden(DEV ? "trailing text after quoted destination" : "");
+  } else {
+    destination = trimAsciiWhitespace(raw.slice(i));
+    if (/[;,]/.test(destination)) return forbidden(DEV ? "multiple refresh assignments" : "");
+  }
+  if (destination === "") return forbidden(DEV ? "empty destination" : "");
+  const sanitizedDestination = sanitizeUrl(destination);
+  if (sanitizedDestination === "") return forbidden(DEV ? "destination uses a disallowed protocol" : "");
+  return { kind: "allowed", delay, destination, sanitizedDestination };
+}
+function resolveMetaRefreshPolicy(attributes) {
+  let httpEquiv;
+  let content;
+  let duplicateName;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of attributes) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) duplicateName = canonical;
+    seen.add(canonical);
+    if (canonical === "http-equiv") httpEquiv = value;
+    else if (canonical === "content") content = value;
+  }
+  if (duplicateName !== void 0) {
+    return forbidden(DEV ? `duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}` : "");
+  }
+  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
+  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
+    return { kind: "not-refresh" };
+  }
+  if (typeof content !== "string") return { kind: "not-refresh" };
+  return parseMetaRefreshContent(content);
+}
+function normalizeMetaAttributes(props) {
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(props)) {
+    const canonical = canonicalAttrName(key);
+    if (seen.has(canonical)) return null;
+    seen.add(canonical);
+    out.set(key, props[key]);
+  }
+  return out;
+}
+function isForbiddenMetaEntry(props) {
+  const normalized = normalizeMetaAttributes(props);
+  if (normalized === null) return true;
+  return resolveMetaRefreshPolicy(normalized).kind === "forbidden";
+}
+
+// src/utils/elementPolicy.ts
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+var SVG_NS = "http://www.w3.org/2000/svg";
+var BLOCKED_ELEMENTS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function canonicalTagName(tag) {
+  return canonicalAttrName(tag);
+}
+function isBlockedElement(tag) {
+  return BLOCKED_ELEMENTS.has(canonicalTagName(tag));
+}
+var CODE_TEXT_ELEMENTS = /* @__PURE__ */ new Set(["script", "style"]);
+function isCodeTextElement(tag) {
+  return CODE_TEXT_ELEMENTS.has(canonicalTagName(tag));
+}
+var ContextualRefusal = {
+  None: 0,
+  /** The element would carry a refresh directive the shared policy forbids. */
+  MetaRefreshForbidden: 1,
+  /** A `<meta>` with a reactive binding may not carry any refresh directive. */
+  MetaRefreshReactive: 2,
+  /** A runtime value may not choose which program a `<script>` runs. */
+  ScriptSource: 3,
+  /** An SVG animation may not target a URL, handler or document attribute. */
+  AnimationTarget: 4,
+  /** A runtime-written `href` may not become an applied stylesheet. */
+  StylesheetSource: 5
+};
+var SCRIPT_SOURCE_ATTRIBUTES = /* @__PURE__ */ new Set(["src", "href", "xlink:href", "type", "language"]);
+var SVG_ANIMATION_ELEMENTS = /* @__PURE__ */ new Set(["animate", "set", "animateMotion", "animateTransform", "animateColor"]);
+var reactiveMetaElements = /* @__PURE__ */ new WeakSet();
+function isHtmlNamespace(el) {
+  return el.namespaceURI === HTML_NS || el.namespaceURI === null;
+}
+function metaSnapshot(el, canonical, value) {
+  const snapshot = /* @__PURE__ */ new Map();
+  const attrs = el.attributes;
+  for (let i = 0; i < attrs.length; i++) {
+    const attr = attrs[i];
+    if (attr.name === canonical) continue;
+    snapshot.set(attr.name, attr.value);
+  }
+  if (canonical !== null && value !== null) snapshot.set(canonical, value);
+  return snapshot;
+}
+function claimReactiveMeta(el) {
+  if (reactiveMetaElements.has(el)) return;
+  reactiveMetaElements.add(el);
+  if (el.getAttribute("content") === null) return;
+  if (resolveMetaRefreshPolicy(metaSnapshot(el, null, null)).kind !== "not-refresh") {
+    el.removeAttribute("content");
+  }
+}
+function metaRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical !== "http-equiv" && canonical !== "content") return ContextualRefusal.None;
+  if (origin === "reactive") claimReactiveMeta(el);
+  if (value === null) return ContextualRefusal.None;
+  if (canonical === "content" && !el.hasAttribute("http-equiv")) return ContextualRefusal.None;
+  const decision = resolveMetaRefreshPolicy(metaSnapshot(el, canonical, value));
+  if (decision.kind === "forbidden") return ContextualRefusal.MetaRefreshForbidden;
+  if (decision.kind !== "not-refresh" && reactiveMetaElements.has(el)) return ContextualRefusal.MetaRefreshReactive;
+  return ContextualRefusal.None;
+}
+function animationRefusal(name, value) {
+  if (value === null || canonicalAttrName(name) !== "attributename") return ContextualRefusal.None;
+  const target = stripControlChars(value);
+  return isUrlAttribute(target) || isEventHandlerAttr(target) || isHtmlContentAttribute(target) ? ContextualRefusal.AnimationTarget : ContextualRefusal.None;
+}
+var runtimeHrefLinks = /* @__PURE__ */ new WeakSet();
+function relHasStylesheet(rel) {
+  if (rel === null) return false;
+  const lower = canonicalAttrName(rel);
+  if (!lower.includes("stylesheet")) return false;
+  const tokens = lower.split(/[\t\n\f\r ]+/);
+  for (let i = 0; i < tokens.length; i++) if (tokens[i] === "stylesheet") return true;
+  return false;
+}
+function stylesheetRefusal(el, name, value, origin) {
+  if (!isHtmlNamespace(el)) return ContextualRefusal.None;
+  const canonical = canonicalAttrName(name);
+  if (canonical === "href") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    if (relHasStylesheet(el.getAttribute("rel"))) return ContextualRefusal.StylesheetSource;
+    runtimeHrefLinks.add(el);
+    return ContextualRefusal.None;
+  }
+  if (canonical === "rel") {
+    if (!relHasStylesheet(value)) return ContextualRefusal.None;
+    return runtimeHrefLinks.has(el) && el.hasAttribute("href") ? ContextualRefusal.StylesheetSource : ContextualRefusal.None;
+  }
+  return ContextualRefusal.None;
+}
+function contextualAttributeRefusal(el, name, value, origin) {
+  const local = el.localName;
+  if (local === "meta") return metaRefusal(el, name, value, origin);
+  if (local === "link") return stylesheetRefusal(el, name, value, origin);
+  if (local === "script") {
+    if (origin === "static" || value === null) return ContextualRefusal.None;
+    return SCRIPT_SOURCE_ATTRIBUTES.has(canonicalAttrName(name)) ? ContextualRefusal.ScriptSource : ContextualRefusal.None;
+  }
+  if (SVG_ANIMATION_ELEMENTS.has(local) && el.namespaceURI === SVG_NS) return animationRefusal(name, value);
+  return ContextualRefusal.None;
+}
+function settleAttributeProvenance(el, name, origin) {
+  if (el.localName !== "link" || canonicalAttrName(name) !== "href") return;
+  if (origin !== "static" && el.hasAttribute("href")) runtimeHrefLinks.add(el);
+  else runtimeHrefLinks.delete(el);
+}
+function isForbiddenMetaSnapshot(attributes) {
+  return resolveMetaRefreshPolicy(attributes).kind === "forbidden";
+}
+
+export {
+  resolveMetaRefreshPolicy,
+  isForbiddenMetaEntry,
+  isBlockedElement,
+  isCodeTextElement,
+  ContextualRefusal,
+  contextualAttributeRefusal,
+  settleAttributeProvenance,
+  isForbiddenMetaSnapshot
+};

package/dist/{chunk-DKXRACVN.js → chunk-44MTL7ED.js}

@@ -1,20 +1,20 @@
-import {
-  stripHtml
-} from "./chunk-2INLLLMZ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  stripHtml
+} from "./chunk-EXXSN3BW.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   forEachSubscriber,
   getSubscriberCount,
   getSubscriberDeps
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   dispose,
   isDev

package/dist/{chunk-3QWBSL5R.js → chunk-4WMSTZ7J.js}

@@ -3,20 +3,23 @@ import {
 } from "./chunk-J6FW5TV6.js";
 import {
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-VWT3VXPL.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-KJ3UKABJ.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  sanitizeCSSDeclaration
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 
 // src/ecosystem/adapters/mobx.ts
 function mobXAdapter(options) {
@@ -121,7 +124,7 @@ var _themeLayers = globalSingleton(
 function commitThemeProperty(root, name, record) {
   const top = record.layers[record.layers.length - 1];
   if (top) {
-    root.style.setProperty(name, top.value);
+    root.style.setProperty(name, sanitizeCSSDeclaration(name, String(top.value), { element: root }));
     return;
   }
   _themeLayers.get(root)?.delete(name);

package/dist/{chunk-H3SRKIYX.js → chunk-62BDYGAG.js}

@@ -3,6 +3,13 @@ var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototyp
 function isUnsafeKey(key) {
   return UNSAFE_KEYS.has(key);
 }
+function readOwnGlobal(key) {
+  if (typeof window === "undefined") return void 0;
+  if (!Object.hasOwn(window, key)) return void 0;
+  const value = window[key];
+  if (typeof Node !== "undefined" && value instanceof Node) return void 0;
+  return value;
+}
 function stripUnsafeKeys(obj) {
   const out = {};
   for (const k of Object.keys(obj)) {
@@ -13,5 +20,6 @@ function stripUnsafeKeys(obj) {
 
 export {
   isUnsafeKey,
+  readOwnGlobal,
   stripUnsafeKeys
 };

package/dist/{chunk-BSY63EM6.js → chunk-C5PEWEGH.js}

@@ -1,15 +1,18 @@
 import {
-  sanitizeUrl
-} from "./chunk-2INLLLMZ.js";
+  isBlockedElement
+} from "./chunk-3ACAAQIN.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   DEV,
   devWarn,
@@ -239,6 +242,9 @@ var DOMPool = class {
    * Get a recycled element or create a new one.
    */
   acquire(tag) {
+    if (isBlockedElement(tag)) {
+      throw new Error(`DOMPool: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const pool = this.pools.get(tag);
     if (pool && pool.length > 0) {
       const el = pool.pop();
@@ -344,10 +350,19 @@ function prefetch(url) {
 }
 function preloadImage(src) {
   return new Promise((resolve, reject) => {
+    const safe = sanitizeUrl(String(src));
+    if (!safe) {
+      reject(
+        new Error(
+          String(src).trim() === "" ? "preloadImage: no image URL was given." : "preloadImage: refusing an image URL outside the URL policy."
+        )
+      );
+      return;
+    }
     const img = new Image();
     img.onload = () => resolve(img);
     img.onerror = reject;
-    img.src = src;
+    img.src = safe;
   });
 }
 

package/dist/{chunk-BC2SECJD.js → chunk-C7AA2CZX.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-7XHATCIH.js";
 import {
   reactiveBinding
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 
 // src/core/rendering/createId.ts
 var COUNTER_KEY = /* @__PURE__ */ Symbol.for("sibujs.createId.v1");

package/dist/{chunk-SLM3IA34.js → chunk-CZPRSWSS.js}

@@ -5,7 +5,7 @@ import {
   resumeTracking,
   suspendTracking,
   track
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   devAssert
 } from "./chunk-NYNYSPK7.js";

package/dist/{chunk-FQRUXCEE.js → chunk-DSID757X.js}

@@ -4,7 +4,7 @@ import {
   notifySubscribers,
   queueSignalNotification,
   recordDependency
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   DEV
 } from "./chunk-NYNYSPK7.js";

package/dist/{chunk-ZVL7TY4K.js → chunk-EGUQLBHE.js}

@@ -1,19 +1,22 @@
-import {
-  isUnsafeKey
-} from "./chunk-H3SRKIYX.js";
 import {
   acquireTitle
 } from "./chunk-52XFPGSN.js";
+import {
+  isUnsafeKey
+} from "./chunk-62BDYGAG.js";
 import {
   globalSingleton
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import {
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   reportError
 } from "./chunk-NYNYSPK7.js";
@@ -533,13 +536,19 @@ function colorScheme() {
 }
 
 // src/browser/format.ts
+var I18N_STATE = /* @__PURE__ */ Symbol.for("sibujs.i18n.v1");
+function activeI18nLocale() {
+  const state = globalThis[I18N_STATE];
+  if (!state) return void 0;
+  return state.getLocale ? state.getLocale() : state.locale?.[0]();
+}
 function formatNumber(value, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, formatOptions).format(value);
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), formatOptions).format(value);
 }
 function formatCurrency(value, currency, options) {
   const { locale, ...formatOptions } = options ?? {};
-  return new Intl.NumberFormat(locale, {
+  return new Intl.NumberFormat(locale ?? activeI18nLocale(), {
     ...formatOptions,
     style: "currency",
     currency
@@ -1508,6 +1517,11 @@ function imageLoader(src) {
     abandonCurrent();
     resetState();
     if (disposed || token !== startToken) return;
+    const safe = sanitizeUrl(String(url));
+    if (!safe) {
+      setStatus("error");
+      return;
+    }
     const img = new Image();
     current = img;
     currentSettled = false;
@@ -1526,7 +1540,7 @@ function imageLoader(src) {
       currentSettled = true;
       setStatus("error");
     };
-    img.src = url;
+    img.src = safe;
   }
   let srcEffectTeardown = null;
   if (typeof src === "function") {