mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-11-14 13:27:13 +00:00
Miguel Ángel
c0ffdc0fb0
Extract cssAttrSelector to packages/core/src/utils/cssSelector.ts and use it (or CSS.escape for browser-side code) at all 12 sites that previously interpolated raw user-authored values into querySelector attribute selectors. A " in a composition ID, script src, or data-start value would produce a malformed selector that throws. Node-side (core compiler/parser): uses the shared cssAttrSelector. Browser-side (runtime, studio): uses native CSS.escape(). Supersedes #1568 which fixed only the 3 bundler sites.
15 lines
439 B
TypeScript
15 lines
439 B
TypeScript
// ponytail: queries DOM by exact attribute match without interpolating
|
|
// the value into a selector string — zero injection surface.
|
|
export function queryByAttr(
|
|
root: ParentNode,
|
|
attr: string,
|
|
value: string,
|
|
tag?: string,
|
|
): Element | null {
|
|
const selector = tag ? `${tag}[${attr}]` : `[${attr}]`;
|
|
for (const el of root.querySelectorAll(selector)) {
|
|
if (el.getAttribute(attr) === value) return el;
|
|
}
|
|
return null;
|
|
}
|