@wix/wix-ui-icons-common 3.189.28 → 3.189.29

package/dist/cjs/core/fetcher.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,15 +17,35 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var fetcher_exports = {};
 __export(fetcher_exports, {
   IconContentFetcher: () => IconContentFetcher,
   createTimeoutSignal: () => createTimeoutSignal,
-  iconContentFetcher: () => iconContentFetcher
+  iconContentFetcher: () => iconContentFetcher,
+  sanitizeSvgContent: () => sanitizeSvgContent
 });
 module.exports = __toCommonJS(fetcher_exports);
+var import_dompurify = __toESM(require("dompurify"));
 const ABORT_SIGNAL_TIMEOUT = 5e3;
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+function sanitizeSvgContent(content) {
+  if (typeof content !== "string" || !import_dompurify.default.isSupported) {
+    return "";
+  }
+  return import_dompurify.default.sanitize(content, {
+    USE_PROFILES: { svg: true, svgFilters: true },
+    NAMESPACE: SVG_NAMESPACE
+  });
+}
 const isTransientError = (error) => error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
 function createTimeoutSignal(timeout) {
   if (typeof AbortSignal.timeout === "function") {
@@ -83,7 +105,7 @@ class IconContentFetcher {
       }
     };
     const request = fetchContent(2).then((data) => {
-      this.cache.set(cacheKey, data.content);
+      this.cache.set(cacheKey, sanitizeSvgContent(data.content));
       this.pendingRequests.delete(cacheKey);
     }).catch((error) => {
       this.pendingRequests.delete(cacheKey);
@@ -102,5 +124,6 @@ const iconContentFetcher = new IconContentFetcher();
 0 && (module.exports = {
   IconContentFetcher,
   createTimeoutSignal,
-  iconContentFetcher
+  iconContentFetcher,
+  sanitizeSvgContent
 });

package/dist/esm/core/fetcher.js

@@ -1,4 +1,15 @@
+import DOMPurify from "dompurify";
 const ABORT_SIGNAL_TIMEOUT = 5e3;
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+function sanitizeSvgContent(content) {
+  if (typeof content !== "string" || !DOMPurify.isSupported) {
+    return "";
+  }
+  return DOMPurify.sanitize(content, {
+    USE_PROFILES: { svg: true, svgFilters: true },
+    NAMESPACE: SVG_NAMESPACE
+  });
+}
 const isTransientError = (error) => error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
 function createTimeoutSignal(timeout) {
   if (typeof AbortSignal.timeout === "function") {
@@ -58,7 +69,7 @@ class IconContentFetcher {
       }
     };
     const request = fetchContent(2).then((data) => {
-      this.cache.set(cacheKey, data.content);
+      this.cache.set(cacheKey, sanitizeSvgContent(data.content));
       this.pendingRequests.delete(cacheKey);
     }).catch((error) => {
       this.pendingRequests.delete(cacheKey);
@@ -76,5 +87,6 @@ const iconContentFetcher = new IconContentFetcher();
 export {
   IconContentFetcher,
   createTimeoutSignal,
-  iconContentFetcher
+  iconContentFetcher,
+  sanitizeSvgContent
 };