@versatiles/svg-renderer 0.5.0 → 0.5.1

package/dist/maplibre.cjs

@@ -16438,6 +16438,39 @@ function querySelector(parent, selector) {
         throw new Error(`Element not found: ${selector}`);
     return el;
 }
+const ALLOWED_TAGS = new Set(['a', 'b', 'i', 'em', 'strong', 'span']);
+function sanitizeHTML(html) {
+    const parser = new DOMParser();
+    const doc = parser.parseFromString(html, 'text/html');
+    return sanitizeNode(doc.body).textContent ?? '';
+}
+function sanitizeNode(node) {
+    if (node.nodeType === Node.TEXT_NODE) {
+        return document.createTextNode(node.textContent ?? '');
+    }
+    if (node.nodeType === Node.ELEMENT_NODE && node instanceof HTMLElement) {
+        const tag = node.tagName.toLowerCase();
+        let span;
+        if (!ALLOWED_TAGS.has(tag)) {
+            span = document.createDocumentFragment();
+        }
+        else {
+            span = document.createElement(tag);
+            if (tag === 'a') {
+                const href = node.getAttribute('href');
+                if (href && /^https?:\/\//i.test(href))
+                    span.setAttribute('href', href);
+                span.setAttribute('target', '_blank');
+                span.setAttribute('rel', 'noopener noreferrer');
+            }
+        }
+        for (const child of Array.from(node.childNodes)) {
+            span.append(sanitizeNode(child));
+        }
+        return span;
+    }
+    return document.createTextNode('');
+}
 class SVGExportControl {
     map;
     container;
@@ -16515,9 +16548,9 @@ class SVGExportControl {
                 .filter((a) => !!a)),
         ];
         if (attributions.length > 0) {
-            noticeEl.textContent =
+            noticeEl.innerHTML =
                 "When publishing the exported map, don't forget to add an attribution like: " +
-                    attributions.join(', ');
+                    attributions.map(sanitizeHTML).join(', ');
         }
         else {
             noticeEl.textContent =