lock down

Author: Rich-Harris

packages/svelte/src/attachments/index.js

@@ -1,3 +1,5 @@
+import { ATTACHMENT_KEY } from '../constants.js';
+
 /**
  * Creates an object key that will be recognised as an attachment when the object is spread onto an element,
  * as a programmatic alternative to using `{@attach ...}`. This can be useful for library authors, though
@@ -20,5 +22,5 @@
  * ```
  */
 export function createAttachmentKey() {
-	return Symbol('@attach');
+	return Symbol(ATTACHMENT_KEY);
 }

packages/svelte/src/constants.js

@@ -54,3 +54,5 @@ export const IGNORABLE_RUNTIME_WARNINGS = /** @type {const} */ ([
  * TODO this is currently unused
  */
 export const ELEMENTS_WITHOUT_TEXT = ['audio', 'datalist', 'dl', 'optgroup', 'select', 'video'];
+
+export const ATTACHMENT_KEY = '@attach';

packages/svelte/src/internal/client/dom/elements/attributes.js

@@ -15,6 +15,7 @@ import {
 } from '../../runtime.js';
 import { attach } from './attachments.js';
 import { clsx } from '../../../shared/attributes.js';
+import { ATTACHMENT_KEY } from '../../../../constants.js';
 
 /**
  * The value/checked attribute in the template actually corresponds to the defaultValue property, so we need
@@ -417,7 +418,9 @@ export function set_attributes(
 	}
 
 	for (let symbol of Object.getOwnPropertySymbols(next)) {
-		attach(element, () => next[symbol]);
+		if (symbol.description === ATTACHMENT_KEY) {
+			attach(element, () => next[symbol]);
+		}
 	}
 
 	return current;