@pantoken/utils 0.2.4 → 0.2.5

package/dist/index.d.mts

@@ -63,6 +63,13 @@ declare function focusOutlineRules(selector?: string): string;
 //#region src/index.d.ts
 /** The colour mode to collapse `light-dark()` to. */
 type Mode = "light" | "dark";
+/**
+ * Strip `<script>` elements and event-handler attributes from SVG markup.
+ *
+ * Defense-in-depth for SVG decoded from vendored data URIs or contributed by plugins.
+ * Not a full HTML parser — relies on the upstream source being trusted and pinned.
+ */
+declare function sanitizeSvg(svg: string): string;
 /** A `var(--custom-prop)` reference (optional fallback); capture group 1 is the property name. */
 declare const VAR_RE: RegExp;
 /** A `light-dark(<light>, <dark>)` value; capture groups 1 and 2 are the two branches. */
@@ -304,4 +311,4 @@ interface TokenUtilityGroup {
  */
 declare function tokenUtilitiesCss(groups: readonly TokenUtilityGroup[], options?: UtilityOptions): string;
 //#endregion
-export { ColorUtilityNames, ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, Mode, ResolveOptions, Rgba, TokenUtilityGroup, UtilityOptions, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, tokenNames, tokenUtilitiesCss, unknownReferences };
+export { ColorUtilityNames, ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, Mode, ResolveOptions, Rgba, TokenUtilityGroup, UtilityOptions, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, sanitizeSvg, tokenNames, tokenUtilitiesCss, unknownReferences };

package/dist/index.mjs

@@ -130,6 +130,25 @@ function focusOutlineRules(selector = FOCUSABLE_SELECTOR) {
 * @module
 * @beta
 */
+/**
+* Strip `<script>` elements and event-handler attributes from SVG markup.
+*
+* Defense-in-depth for SVG decoded from vendored data URIs or contributed by plugins.
+* Not a full HTML parser — relies on the upstream source being trusted and pinned.
+*/
+function sanitizeSvg(svg) {
+	let sanitized = svg;
+	let previous;
+	do {
+		previous = sanitized;
+		sanitized = sanitized.replace(/<script\b[^>]*>[\s\S]*?<\/script\b[^>]*>/gi, "");
+	} while (sanitized !== previous);
+	do {
+		previous = sanitized;
+		sanitized = sanitized.replace(/\son\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "");
+	} while (sanitized !== previous);
+	return sanitized;
+}
 const VAR_SOURCE = "var\\(\\s*(--[\\w-]+)[^)]*\\)";
 const LIGHT_DARK_SOURCE = "^light-dark\\(\\s*(.+?)\\s*,\\s*(.+?)\\s*\\)$";
 /** A `var(--custom-prop)` reference (optional fallback); capture group 1 is the property name. */
@@ -401,4 +420,4 @@ function tokenUtilitiesCss(groups, options = {}) {
 	})).join("\n")}\n`;
 }
 //#endregion
-export { ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, tokenNames, tokenUtilitiesCss, unknownReferences };
+export { ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, sanitizeSvg, tokenNames, tokenUtilitiesCss, unknownReferences };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pantoken/utils",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Shared pantoken helpers: token reference resolver, typed regexes (arkregex), name-case, and hex-colour parsing.",
   "homepage": "https://pantoken.iywahl.com",
   "bugs": "https://github.com/thedannywahl/pantoken/issues",