pj 8c7470a1a6 fix(web-runtime): use CSS.escape and validate tag-name selectors ...

The previous cssEscape only handled " and \, leaving newlines/control
chars to break out of attribute string literals. Delegate to the
platform CSS.escape per CSSOM spec.

The `tag` selector branch returned the bare value through cssEscape,
which doesn't prevent pseudo-classes (`*:hover`) from injecting into
the surrounding selector. Add a positive whitelist; values that don't
match a tag-name pattern collapse to a never-matching `:not(*)`.

Also switch class selectors to `[class~="..."]` to remove the only
identifier-context use of cssEscape.

2026-05-03 10:59:06 +07:00

..

spec

fix(web-runtime): use CSS.escape and validate tag-name selectors

2026-05-03 10:59:06 +07:00