From a3c372a147e961651eeedbab394b3a5714d9eca1 Mon Sep 17 00:00:00 2001
From: onlybugs05 <onlybugs05@gmail.com>
Date: Sun, 3 May 2026 13:00:27 +0530
Subject: [PATCH] fix: prevent CSS injection in style directives

---
 .../svelte/src/internal/shared/attributes.js  | 45 ++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/packages/svelte/src/internal/shared/attributes.js b/packages/svelte/src/internal/shared/attributes.js
index 487a40baf3..df42c8a81f 100644
--- a/packages/svelte/src/internal/shared/attributes.js
+++ b/packages/svelte/src/internal/shared/attributes.js
@@ -89,6 +89,49 @@ export function to_class(value, hash, directives) {
 	return classname === '' ? null : classname;
 }
 
+/**
+ * @param {any} value
+ * @returns {string}
+ */
+function escape_style_value(value) {
+	var str = String(value);
+	var escaped = '';
+	/** @type {boolean | '"' | "'"} */
+	var in_str = false;
+	var in_apo = 0;
+	var in_comment = false;
+
+	const len = str.length;
+	for (var i = 0; i < len; i++) {
+		var c = str[i];
+
+		if (in_comment) {
+			if (c === '/' && i > 0 && str[i - 1] === '*') {
+				in_comment = false;
+			}
+		} else if (in_str) {
+			if (c === in_str) {
+				in_str = false;
+			}
+		} else if (c === '/' && i + 1 < len && str[i + 1] === '*') {
+			in_comment = true;
+		} else if (c === '"' || c === "'") {
+			in_str = c;
+		} else if (c === '(') {
+			in_apo++;
+		} else if (c === ')') {
+			in_apo--;
+		}
+
+		if (c === ';' && !in_comment && in_str === false && in_apo === 0) {
+			continue;
+		}
+		escaped += c;
+	}
+
+	return escaped;
+}
+
 /**
  *
  * @param {Record<string,any>} styles
@@ -101,7 +144,7 @@ function append_styles(styles, important = false) {
 	for (var key of Object.keys(styles)) {
 		var value = styles[key];
 		if (value != null && value !== '') {
-			css += ' ' + key + ': ' + value + separator;
+			css += ' ' + key + ': ' + escape_style_value(value) + separator;
 		}
 	}