first commit

packages/core/test/jsx-security.test.ts

@@ -0,0 +1,13 @@
+import { expect, test } from "bun:test";
+import { jsx } from "../src/jsx-runtime.ts";
+
+test("JSX rejects dynamic tag-name injection", () => {
+  expect(() => jsx("div><script>alert(1)</script><div" as "div", {})).toThrow(
+    "Invalid JSX tag name",
+  );
+});
+
+test("JSX skips invalid spread attribute names", () => {
+  const html = jsx("div", { 'title" onmouseover="alert(1)': "x", title: "safe" }).toString();
+  expect(html).toBe('<div title="safe"></div>');
+});