@genarou/blazir-icons 1.2.16 → 1.3.2

package/dist/utils/sanitize.js

@@ -0,0 +1,109 @@
+/**
+ * sanitize.ts — Lightweight SVG sanitizer. Zero dependencies.
+ *
+ * Browser: uses the native DOMParser with image/svg+xml for robust, spec-compliant parsing.
+ * SSR:     regex-based fallback that strips the most dangerous vectors.
+ *
+ * Threat model (SVG inner content — not the <svg> tag itself):
+ *   ✗ <script> blocks
+ *   ✗ <foreignObject> — embeds arbitrary HTML
+ *   ✗ <iframe>, <object>, <embed>, <link>, <base>
+ *   ✗ Event handlers  — on*, xlink:actuate, etc.
+ *   ✗ javascript: / vbscript: / data: URIs in href / src / action
+ *   ✗ CSS expression() / javascript: in style attributes
+ */
+// Elements that must never appear inside sanitized SVG content
+const BLOCKED_ELEMENTS = new Set([
+    "script",
+    "foreignobject",
+    "iframe",
+    "object",
+    "embed",
+    "link",
+    "base",
+    "meta",
+    "title", // avoid overriding the a11y <title> from IconBase
+]);
+// Attribute names that carry dangerous protocols
+const HREF_ATTRS = new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "xlink:href",
+]);
+// Protocols that are never safe in SVG attributes
+const BLOCKED_PROTOCOLS = ["javascript:", "vbscript:", "data:"];
+function isDangerousAttr(name, value) {
+    const n = name.toLowerCase();
+    // Inline event handlers — onerror, onload, onclick, onmouseover, etc.
+    if (n.startsWith("on"))
+        return true;
+    // href / src with dangerous protocol
+    if (HREF_ATTRS.has(n)) {
+        const v = value.trim().toLowerCase().replace(/[\t\n\r ]/g, "");
+        return BLOCKED_PROTOCOLS.some((p) => v.startsWith(p));
+    }
+    // CSS expressions or javascript: inside style=""
+    if (n === "style" && /expression\s*\(|javascript:/i.test(value))
+        return true;
+    return false;
+}
+function sanitizeNode(node) {
+    if (BLOCKED_ELEMENTS.has(node.tagName.toLowerCase())) {
+        node.remove();
+        return;
+    }
+    // Strip dangerous attributes
+    const toRemove = [];
+    for (const { name, value } of Array.from(node.attributes)) {
+        if (isDangerousAttr(name, value))
+            toRemove.push(name);
+    }
+    toRemove.forEach((a) => node.removeAttribute(a));
+    // Recurse — iterate a snapshot to avoid live-collection issues after remove()
+    for (const child of Array.from(node.children)) {
+        sanitizeNode(child);
+    }
+}
+// ─── SSR regex fallback ───────────────────────────────────────────────────────
+// Not as robust as the DOM-based approach but handles the most critical vectors.
+function ssrSanitize(raw) {
+    return raw
+        .replace(/<script[\s\S]*?<\/script\s*>/gi, "")
+        .replace(/<foreignObject[\s\S]*?<\/foreignObject\s*>/gi, "")
+        .replace(/<(iframe|object|embed|link|base|meta)[^>]*>/gi, "")
+        .replace(/\son\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s/>]*)/gi, "")
+        .replace(/\s(?:xlink:)?href\s*=\s*["'](?:javascript|vbscript|data):[^"']*["']/gi, "")
+        .replace(/style\s*=\s*"[^"]*expression\s*\([^"]*"/gi, 'style=""')
+        .replace(/style\s*=\s*'[^']*expression\s*\([^']*'/gi, "style=''");
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Sanitizes raw SVG inner markup against XSS vectors.
+ *
+ * Safe to call with content from external APIs or user input.
+ * For static, trusted SVG strings defined in your own code, pass
+ * `sanitize={false}` to `CustomIcon` to skip the overhead entirely.
+ *
+ * @param raw - SVG inner markup (paths, circles, etc. — not the <svg> tag)
+ * @returns Sanitized SVG markup string, empty string on parse failure
+ */
+export function sanitizeSvg(raw) {
+    if (!raw || typeof raw !== "string")
+        return "";
+    // ── SSR ──────────────────────────────────────────────────────────────────
+    if (typeof document === "undefined")
+        return ssrSanitize(raw);
+    // ── Browser — native SVG+XML parser ──────────────────────────────────────
+    const parser = new DOMParser();
+    const doc = parser.parseFromString(`<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">${raw}</svg>`, "image/svg+xml");
+    // DOMParser signals XML parse errors via a <parsererror> element
+    if (doc.querySelector("parsererror"))
+        return "";
+    const root = doc.documentElement;
+    for (const child of Array.from(root.children)) {
+        sanitizeNode(child);
+    }
+    return root.innerHTML;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genarou/blazir-icons",
-  "version": "1.2.16",
+  "version": "1.3.2",
   "type": "module",
   "private": false,
   "publishConfig": {
@@ -22,6 +22,15 @@
       "types": "./dist/index.d.ts",
       "svelte": "./dist/index.js",
       "default": "./dist/index.js"
+    },
+    "./icons/*": {
+      "types": "./dist/icons/*.svelte.d.ts",
+      "svelte": "./dist/icons/*.svelte",
+      "default": "./dist/icons/*.svelte"
+    },
+    "./plugin": {
+      "types": "./dist/plugin/index.d.ts",
+      "default": "./dist/plugin/index.js"
     }
   },
   "files": [
@@ -29,24 +38,15 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "dev": "vite",
-    "build": "svelte-package",
-    "preview": "vite preview",
-    "prepublishOnly": "npm run build",
-    "clean": "rm -rf dist",
-    "prebuild": "npm run clean",
-    "try": "npm run build && vite --config play/vite.config.js",
-    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
-  },
   "devDependencies": {
     "@sveltejs/kit": "^2.47.1",
     "@sveltejs/package": "^2.5.0",
     "@sveltejs/vite-plugin-svelte": "^3.1.2",
+    "@types/node": "^25.5.0",
     "svelte": "^5.38.6",
     "svelte-check": "^4.3.3",
     "typescript": "^5.9.2",
+    "unplugin": "^3.0.0",
     "vite": "^5.4.19"
   },
   "peerDependencies": {
@@ -64,5 +64,15 @@
   "homepage": "https://github.com/GenaroUG/blazir-icons#readme",
   "bugs": {
     "url": "https://github.com/GenaroUG/blazir-icons/issues"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "svelte-package",
+    "preview": "vite preview",
+    "clean": "rm -rf dist",
+    "prebuild": "npm run clean",
+    "try": "npm run build && vite --config play/vite.config.js",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
   }
-}
+}

package/dist/icons/Aws.svelte

@@ -1,19 +0,0 @@
-<!-- src/lib/icons/Aws.svelte -->
-<script lang="ts">
-  import IconBase from "../IconBase.svelte";
-  import type { IconProps } from "../types";
-
-  const props: IconProps = $props();
-</script>
-
-<IconBase
-  {...props}
-  mode="solid"
-  viewBox="0 0 24 24"
-  ariaLabel={props.ariaLabel ?? "AWS logo"}
-  title={props.title ?? "Aws"}
->
-  <path
-    d="M7.64 10.38c0 .25.02.45.07.62c.05.12.12.28.21.46c.04.04.05.1.05.15c0 .07-.04.13-.13.2l-.42.28c-.06.04-.12.06-.17.06c-.07 0-.13-.04-.2-.1c-.09-.1-.17-.2-.24-.31c-.06-.11-.13-.24-.2-.39c-.52.61-1.17.92-1.96.92c-.56 0-1-.16-1.33-.48c-.32-.32-.49-.75-.49-1.29c0-.55.2-1 .6-1.36c.41-.34.95-.52 1.63-.52c.23 0 .44.02.71.06c.23.03.5.08.76.14v-.48c0-.51-.1-.84-.31-1.07c-.22-.21-.57-.3-1.08-.3c-.24 0-.48.03-.72.08c-.25.06-.49.13-.72.23c-.11.04-.2.07-.23.08c-.05.02-.08.02-.11.02c-.09 0-.14-.06-.14-.2v-.33c0-.1.01-.18.05-.23q.045-.075.18-.12c.24-.14.51-.24.84-.32a4 4 0 0 1 1.04-.13q1.185 0 1.74.54c.37.36.55.91.55 1.64v2.15zm-2.7 1.02c.22 0 .44-.04.68-.12s.45-.23.63-.43c.11-.13.19-.27.25-.43c0-.16.05-.35.05-.58v-.27c-.2-.07-.4-.07-.62-.12a7 7 0 0 0-.62-.04c-.45 0-.77.09-.99.27s-.32.43-.32.76c0 .32.07.56.24.71c.16.17.39.25.7.25m5.34.71a.6.6 0 0 1-.28-.06c-.03-.05-.08-.14-.12-.26L8.32 6.65c-.04-.15-.06-.22-.06-.27c0-.11.05-.17.16-.17h.65c.13 0 .22.02.26.07c.06.04.1.13.14.26l1.11 4.4l1.04-4.4c.03-.13.07-.22.13-.26c.05-.04.14-.07.25-.07h.55c.12 0 .21.02.26.07c.05.04.1.13.13.26L14 11l1.14-4.46c.04-.13.09-.22.13-.26c.06-.04.14-.07.26-.07h.62c.11 0 .17.06.17.17c0 .03-.01 .07-.02 .12c0 0-.02 .08-.04 .15l-1.61 5.14c-.04 .14-.08 .21-.15 .26c-.04 .04-.13 .07-.24 .07h-.57c-.13 0-.19-.02-.27-.07a.45 .45 0 0 1-.12-.26L12.27 7.5l-1.03 4.28q-.045 .195-.12 .27a.5 .5 0 0 1-.27 .06zm8.55 .18c-.33 0-.7-.04-1.03-.12s-.59-.17-.76-.26a.5 .5 0 0 1-.21-.19a.4 .4 0 0 1-.04-.18v-.34c0-.14 .05-.2 .15-.2h.12c.04 0 .1 .05 .17 .08c.22 .1 .47 .18 .73 .23c.27 .05 .54 .08 .79 .08c.42 0 .75-.07 .97-.22c.23-.17 .35-.36 .35-.63c0-.19-.07-.34-.18-.47c-.12-.12-.35-.24-.67-.34l-.97-.3c-.48-.16-.84-.38-1.06-.68a1.58 1.58 0 0 1-.33-.97c0-.28 .06-.52 .18-.73c.12-.22 .28-.4 .46-.55c.22-.15 .44-.26 .71-.34q.39-.12 .84-.12q.21 0 .45 .03c.14 .02 .28 .05 .42 .07c.14 .04 .26 .07 .38 .11s.2 .08 .28 .12c.09 .05 .16 .1 .2 .16s.06 .13 .06 .22v.32q0 .21-.15 .21c-.05 0-.14-.03-.26-.08c-.37-.17-.8-.26-1.27-.26c-.38 0-.66 .06-.89 .19c-.2 .12-.31 .32-.31 .59c0 .19 .07 .35 .2 .47c.13 .13 .38 .25 .73 .37l.95 .3c.48 .14 .82 .36 1.03 .64q.3 .405 .3 .93c0 .28-.06 .54-.17 .77c-.12 .22-.28 .42-.5 .58c-.19 .17-.44 .29-.72 .38s-.62 .13-.95 .13m1.25 3.24C17.89 17.14 14.71 18 12 18c-3.85 0-7.3-1.42-9.91-3.77c-.21-.19-.02-.44 .23-.29c2.82 1.63 6.29 2.62 9.89 2.62c2.43 0 5.1-.5 7.55-1.56c.37-.15 .68 .26 .32 .53M21 14.5c-.29-.37-1.86-.18-2.57-.1c-.21 .03-.24-.16-.05-.3c1.25-.87 3.31-.6 3.54-.33c.24 .3-.06 2.36-1.23 3.34c-.19 .15-.36 .07-.28-.11c.27-.68 .86-2.16 .59-2.5"
-  />
-</IconBase>

package/dist/icons/Aws.svelte.d.ts

@@ -1,4 +0,0 @@
-import type { IconProps } from "../types";
-declare const Aws: import("svelte").Component<IconProps, {}, "">;
-type Aws = ReturnType<typeof Aws>;
-export default Aws;

package/dist/icons/Facebook.svelte

@@ -1,18 +0,0 @@
-<!-- src/lib/icons/FacebookAlt.svelte -->
-<script lang="ts">
-  import IconBase from "../IconBase.svelte";
-  import type { IconProps } from "../types";
-  const props: IconProps = $props();
-</script>
-
-<IconBase
-  {...props}
-  mode="solid"
-  viewBox="0 0 24 24"
-  ariaLabel={props.ariaLabel ?? "Facebook Alt"}
-  title={props.title ?? ""}
->
-  <path
-    d="M13.458 21.696c4.693-.704 8.292-4.753 8.292-9.642c0-5.385-4.365-9.75-9.75-9.75s-9.75 4.365-9.75 9.75c0 4.89 3.599 8.938 8.292 9.642v-6.798h-2.05a.486.486 0 0 1-.486-.486v-1.843c0-.269.218-.486.486-.486h2.05l-.072-1.943c0-.942.175-2.471 1.342-3.307c.816-.583 1.423-.693 2.397-.693c.845 0 1.426.084 1.81.14l.188.025a.193.193 0 0 1 .168.192v2.04c0 .113-.095.2-.205.194h-.038c-.114.004-.71.029-1.216.029c-.89 0-1.458.406-1.458 1.755v1.568h2.192c.3 0 .529.27.48.566l-.28 1.843a.486.486 0 0 1-.479.406h-1.913z"
-  />
-</IconBase>

package/dist/icons/Facebook.svelte.d.ts

@@ -1,4 +0,0 @@
-import type { IconProps } from "../types";
-declare const Facebook: import("svelte").Component<IconProps, {}, "">;
-type Facebook = ReturnType<typeof Facebook>;
-export default Facebook;

package/dist/icons/Golang.svelte

@@ -1,17 +0,0 @@
-<script lang="ts">
-  import IconBase from "../IconBase.svelte";
-  import type { IconProps } from "../types";
-  const props: IconProps = $props();
-</script>
-
-<IconBase
-  {...props}
-  mode="outline"
-  viewBox="0 0 24 24"
-  ariaLabel={props.ariaLabel ?? "Golang"}
-  title={props.title ?? ""}
->
-  <path
-    d="M15.695 14.305c1.061 1.06 2.953.888 4.226-.384c1.272-1.273 1.444-3.165.384-4.226s-2.953-.888-4.226.384c-1.272 1.273-1.444 3.165-.384 4.226M12.68 9.233c-1.084-.497-2.545-.191-3.591.846c-1.284 1.273-1.457 3.165-.388 4.226c1.07 1.06 2.978.888 4.261-.384A3.67 3.67 0 0 0 14 12h-2.427M5.5 15H4m2-6H4m1 3H2"
-  />
-</IconBase>

package/dist/icons/Golang.svelte.d.ts

@@ -1,4 +0,0 @@
-import type { IconProps } from "../types";
-declare const Golang: import("svelte").Component<IconProps, {}, "">;
-type Golang = ReturnType<typeof Golang>;
-export default Golang;

package/dist/icons/Google.svelte

@@ -1,18 +0,0 @@
-<!-- src/lib/icons/Google.svelte -->
-<script lang="ts">
-  import IconBase from "../IconBase.svelte";
-  import type { IconProps } from "../types";
-  const props: IconProps = $props();
-</script>
-
-<IconBase
-  {...props}
-  mode="solid"
-  viewBox="0 0 24 24"
-  ariaLabel={props.ariaLabel ?? "Google"}
-  title={props.title ?? ""}
->
-  <path
-    d="M20.855 10.361a.2.2 0 0 0-.194-.161H12.2a.2.2 0 0 0-.2.2v3.2c0 .11.09.2.2.2h4.886A5.398 5.398 0 0 1 6.6 12A5.4 5.4 0 0 1 12 6.6a5.37 5.37 0 0 1 3.44 1.245a.205.205 0 0 0 .276-.01l2.266-2.267a.197.197 0 0 0-.007-.286A8.95 8.95 0 0 0 12 3a9 9 0 1 0 9 9c0-.547-.051-1.113-.145-1.639"
-  />
-</IconBase>

package/dist/icons/Google.svelte.d.ts

@@ -1,4 +0,0 @@
-import type { IconProps } from "../types";
-declare const Google: import("svelte").Component<IconProps, {}, "">;
-type Google = ReturnType<typeof Google>;
-export default Google;

package/dist/icons/Paypal.svelte

@@ -1,21 +0,0 @@
-<script lang="ts">
-  import IconBase from "../IconBase.svelte";
-  import type { IconProps } from "../types";
-
-  const props: IconProps = $props();
-</script>
-
-<IconBase
-  {...props}
-  mode="solid"
-  viewBox="0 0 24 24"
-  ariaLabel={props.ariaLabel ?? "Letter G icon"}
-  title={props.title ?? ""}
->
-  <path
-    d="M9.93 12.99c.1 0 2.42.1 3.8-.24h.01c1.59-.39 3.8-1.51 4.37-5.17c0 0 1.27-4.58-5.03-4.58H7.67c-.49 0-.91.36-.99.84L4.38 18.4c-.05.3.19.58.49.58H8.3l.84-5.32c.06-.38.39-.67.79-.67"
-  />
-  <path
-    d="M18.99 8.29c-.81 3.73-3.36 5.7-7.42 5.7H10.1l-1.03 6.52c-.04.26.16.49.42.49h1.9c.34 0 .64-.25.69-.59c.08-.4.52-3.32.61-3.82c.05-.34.35-.59.69-.59h.44c2.82 0 5.03-1.15 5.68-4.46c.26-1.34.12-2.44-.51-3.25"
-  />
-</IconBase>

package/dist/icons/Paypal.svelte.d.ts

@@ -1,4 +0,0 @@
-import type { IconProps } from "../types";
-declare const Paypal: import("svelte").Component<IconProps, {}, "">;
-type Paypal = ReturnType<typeof Paypal>;
-export default Paypal;