/**
 * SVG sanitization utilities
 * Prevents XSS attacks from user-provided SVG content
 */
import DOMPurify from 'isomorphic-dompurify'

/**
 * Sanitize SVG content to prevent XSS attacks
 * Only allows safe SVG elements and attributes
 */
export const sanitizeSvg = (svg: string): string => {
  return DOMPurify.sanitize(svg, {
    USE_PROFILES: { svg: true, svgFilters: true },
    ADD_TAGS: ['use', 'defs', 'symbol'],
    ADD_ATTR: [
      'viewBox',
      'fill',
      'class',
      'stroke',
      'stroke-width',
      'd',
      'cx',
      'cy',
      'r',
      'x',
      'y',
      'width',
      'height',
      'transform',
      'xmlns',
      'xmlns:xlink',
      'xlink:href',
      'preserveAspectRatio',
      'clip-rule',
      'fill-rule',
    ],
    FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'style'],
    FORBID_ATTR: ['onload', 'onerror', 'onclick', 'onmouseover'],
  })
}
