Severity: 🟢 Low (CSS injection — no HTML breakout)
Location
src/ssr/renderer.ts:140-150 (setStyle).
Description
Style property names/values from an evaluated bq-style object are concatenated into the inline style attribute with no CSS-level validation. Attribute-level escaping prevents HTML breakout (" is entity-encoded on serialize), so this is not XSS, but untrusted style objects can inject arbitrary extra declarations for UI-redress/clickjacking or data exfiltration (position: fixed, background: url(...)).
Reproduced: { width: 'x;} body{display:none' } → style="width: x;} body{display:none;" (contained within the attribute, but the extra declaration is injected).
Suggested fix
Validate declaration values (reject ;/}/url( in untrusted values, or run through a CSS property/value allowlist) before concatenation.
Filed as part of a full-codebase security & correctness audit.
Severity: 🟢 Low (CSS injection — no HTML breakout)
Location
src/ssr/renderer.ts:140-150(setStyle).Description
Style property names/values from an evaluated
bq-styleobject are concatenated into the inlinestyleattribute with no CSS-level validation. Attribute-level escaping prevents HTML breakout ("is entity-encoded on serialize), so this is not XSS, but untrusted style objects can inject arbitrary extra declarations for UI-redress/clickjacking or data exfiltration (position: fixed,background: url(...)).Reproduced:
{ width: 'x;} body{display:none' }→style="width: x;} body{display:none;"(contained within the attribute, but the extra declaration is injected).Suggested fix
Validate declaration values (reject
;/}/url(in untrusted values, or run through a CSS property/value allowlist) before concatenation.Filed as part of a full-codebase security & correctness audit.