@thunderid/browser 1.0.7 → 1.0.9

package/dist/cjs/index.cjs

@@ -3633,6 +3633,23 @@ const AVATAR_PALETTES = [
 * without needing the actual palette values.
 */
 const AVATAR_GRADIENT_COUNT = AVATAR_PALETTES.length;
+const XML_ESCAPES = {
+	"\"": """,
+	"&": "&",
+	"'": "'",
+	"<": "&lt;",
+	">": "&gt;"
+};
+/**
+* Escapes a caller-supplied value for interpolation into SVG text.
+*/
+const escapeXml = (value) => value.replace(/["&'<>]/g, (ch) => XML_ESCAPES[ch]);
+/**
+* Encodes an SVG document as a data URI. Lone UTF-16 surrogates are replaced with U+FFFD
+* first, since `encodeURIComponent` throws a `URIError` on them. `Array.from` iterates by
+* code point, so a surrogate it yields on its own is unpaired.
+*/
+const toSvgDataUri = (svg) => `data:image/svg+xml,${encodeURIComponent(Array.from(svg, (ch) => ch.length === 1 && ch >= "\ud800" && ch <= "\udfff" ? "�" : ch).join(""))}`;
 /**
 * Fills in `params.content` when the spec itself didn't carry one, deriving it from a raw
 * seed name (e.g. an app or user display name) — extracting initials for letter variants,
@@ -3683,11 +3700,10 @@ const generateGradientAvatar = ({ shape, variant, content, colors, bg }) => {
 	let text = "";
 	if (variant !== "blank") {
 		const letterCount = variant === "one_letter" ? 1 : 2;
-		const initials = (content || "A").toUpperCase().slice(0, letterCount);
+		const initials = escapeXml(Array.from((content || "A").toUpperCase()).slice(0, letterCount).join(""));
 		text = `<text x="50" y="64" font-family="Helvetica,Arial,sans-serif" font-weight="700" font-size="${letterCount === 1 ? 46 : 34}" text-anchor="middle" fill="#fff">${initials}</text>`;
 	}
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-animal icons, applying the requested background
@@ -3699,8 +3715,7 @@ const generateAnonymousAnimalAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ANIMAL_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ANIMAL_ICONS, content) ? content : pickAnonymousAvatarName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-entity icons (application/organization/resource-server
@@ -3712,8 +3727,7 @@ const generateAnonymousEntityAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ENTITY_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ENTITY_ICONS, content) ? content : pickAnonymousEntityName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Generates an avatar image as an `svg+xml` data URI from a fully-resolved {@link AvatarParams}.