diff --git a/sigpro_work.js b/sigpro_work.js index 13f60ed..6c2095b 100644 --- a/sigpro_work.js +++ b/sigpro_work.js @@ -5,7 +5,11 @@ const effectQueue = new Set(); let isFlushing = false; const MOUNTED_NODES = new WeakMap(); const reactiveCache = new WeakMap(); - +const DANGEROUS_PROTOCOLS = /^(javascript|data|vbscript):/i; +const sanitizeUrl = (url) => { + const str = String(url ?? '').trim().toLowerCase(); + return DANGEROUS_PROTOCOLS.test(str) ? '#' : str; +}; const doc = document; const createEl = (t) => doc.createElement(t); const createText = (t) => doc.createTextNode(String(t ?? "")); @@ -61,7 +65,7 @@ const $ = (val, key = null) => { return sig; }; -const $C = (fn) => { +const Computed = (fn) => { const subs = new Set(); let cached, dirty = true; @@ -89,7 +93,7 @@ const $C = (fn) => { return sig; }; -const $O = (obj) => { +const Store = (obj) => { if (obj === null || typeof obj !== "object" || obj._isSig) return obj; if (reactiveCache.has(obj)) return reactiveCache.get(obj); @@ -105,7 +109,7 @@ const $O = (obj) => { } const value = Reflect.get(target, key); - return (typeof value === "object" && value !== null) ? $O(value) : value; + return (typeof value === "object" && value !== null) ? Store(value) : value; }, set(target, key, value) { const prev = Reflect.get(target, key); @@ -205,7 +209,8 @@ const Tag = (tag, props = {}, children = []) => { el[k] = !!val; val ? el.setAttribute(k, "") : el.removeAttribute(k); } else { - el.setAttribute(k, val); + const finalVal = (k === 'src' || k === 'href') ? sanitizeUrl(val) : val; + el.setAttribute(k, finalVal); } }; if (typeof v === "function") { @@ -419,7 +424,7 @@ const Mount = (component, target) => { return instance; }; -const SigPro = { $, $C, $O, untrack, Render, Effect, Watch, Tag, If, For, Router, Mount, Share, Use }; +const SigPro = { $, Computed, Store, untrack, Render, Effect, Watch, Tag, If, For, Router, Mount, Share, Use }; if (typeof window !== "undefined") { Object.assign(window, SigPro); @@ -433,5 +438,6 @@ if (typeof window !== "undefined") { window.SigPro = Object.freeze(SigPro); } -export { $, $C, $O, untrack, Render, Effect, Watch, Tag, If, For, Router, Mount, Share, Use }; +export { $, Computed, Store, untrack, Render, Effect, Watch, Tag, If, For, Router, Mount, Share, Use }; +export { Tag as jsx, Tag as jsxs, Tag as Fragment }; export default SigPro; \ No newline at end of file