René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][view] bq-on auto-invoke heuristic keys on includes('(') → silent no-op misfire","articleBody":"## Severity: 🟢 Low (correctness — silent no-op)\n\n## Location\n[`src/view/directives/on.ts:18`](../blob/main/src/view/directives/on.ts#L18); [`src/view/directives/on-modifiers.ts:159`](../blob/main/src/view/directives/on-modifiers.ts#L159).\n\n## Description\n`bq-on` decides \"bare function reference vs. a call\" by testing whether the expression string contains `(`. This misfires on expressions that contain a paren without being the top-level call. Example:\n```html\n\u003cbutton bq-on:click=\"items.find(x=\u003ex).handler\"\u003e\n```\ncontains `(`, so it is treated as a full expression, evaluated once, and the returned `handler` function is **never invoked** — the click silently does nothing. Conversely a bare `handler` (no paren) is auto-invoked but with `this` unbound.\n\n## Suggested fix\nEvaluate the expression via `evaluateRaw`; if the result is a function, invoke it with the event, otherwise treat the evaluation itself as the side effect. This removes the fragile string heuristic entirely.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:51.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/180/bQuery/issues/180"}