Add business logo branding support

src/lib/svg-sanitize.ts

@@ -0,0 +1,38 @@
+import "server-only";
+
+/**
+ * Lightweight defense-in-depth pass over uploaded SVG markup before it is
+ * stored. Strips executable content (scripts, event handlers, external
+ * references) so a malicious SVG can't run script if it's ever rendered
+ * inline (dangerouslySetInnerHTML) rather than via <img src>. Not a full
+ * parser — good enough for a self-uploaded logo, not a substitute for
+ * treating SVG as active content from an untrusted source.
+ */
+export function sanitizeSvg(input: string): string {
+  let svg = input;
+
+  // Strip <script>...</script> blocks and self-closing <script/> tags.
+  svg = svg.replace(/<script[\s\S]*?<\/script\s*>/gi, "");
+  svg = svg.replace(/<script\b[^>]*\/>/gi, "");
+
+  // Strip on* event handler attributes (onload, onclick, onerror, ...).
+  svg = svg.replace(/\son\w+\s*=\s*"[^"]*"/gi, "");
+  svg = svg.replace(/\son\w+\s*=\s*'[^']*'/gi, "");
+  svg = svg.replace(/\son\w+\s*=\s*[^\s>]+/gi, "");
+
+  // Strip javascript: URIs in href/xlink:href/src attributes.
+  svg = svg.replace(
+    /((?:xlink:href|href|src)\s*=\s*)"javascript:[^"]*"/gi,
+    '$1""',
+  );
+  svg = svg.replace(
+    /((?:xlink:href|href|src)\s*=\s*)'javascript:[^']*'/gi,
+    "$1''",
+  );
+
+  // Strip <foreignObject> (can embed arbitrary HTML) and <iframe>.
+  svg = svg.replace(/<foreignObject[\s\S]*?<\/foreignObject\s*>/gi, "");
+  svg = svg.replace(/<iframe[\s\S]*?<\/iframe\s*>/gi, "");
+
+  return svg;
+}