[Low][view] bq-on auto-invoke heuristic keys on includes('(') → silent no-op misfire #180

Severity: 🟢 Low (correctness — silent no-op)

Location

src/view/directives/on.ts:18; src/view/directives/on-modifiers.ts:159.

Description

bq-on decides "bare function reference vs. a call" by testing whether the expression string contains (. This misfires on expressions that contain a paren without being the top-level call. Example:

<button bq-on:click="items.find(x=>x).handler">

contains (, so it is treated as a full expression, evaluated once, and the returned handler function is never invoked — the click silently does nothing. Conversely a bare handler (no paren) is auto-invoked but with this unbound.

Suggested fix

Evaluate the expression via evaluateRaw; if the result is a function, invoke it with the event, otherwise treat the evaluation itself as the side effect. This removes the fragile string heuristic entirely.

Filed as part of a full-codebase security & correctness audit.