// ─────────────────────────────────────────────────────────────────────────────
// Input sanitisation & validation utilities
//
// Currently focused on SVG sanitisation for user-uploaded or generated SVGs
// that will be rendered inline.  Strips script tags, event handlers and
// `javascript:` URIs.
// ─────────────────────────────────────────────────────────────────────────────

/**
 * Remove XSS vectors from an SVG string.
 *
 * Three passes are applied (in order):
 *   1. Strip `<script>…</script>` blocks (handles nested malformed markup).
 *   2. Strip HTML event-handler attributes (`onload="…"`, `onclick='…'`, etc.).
 *   3. Strip `javascript:` pseudo-protocol URIs.
 *
 * @param svg - Raw SVG markup.
 * @returns   Sanitised SVG markup safe for client-side rendering.
 */
export function sanitizeSvg(svg: string): string {
  return svg
    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "")
    .replace(/\bon\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
    .replace(/javascript\s*:/gi, "")
}
