{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["/**\n * Validate SVG content for security vulnerabilities\n * Detects and blocks malicious patterns commonly used in SVG-based attacks\n */\nexport function validateSvg(buffer: Buffer): boolean {\n  try {\n    const content = buffer.toString('utf8')\n\n    const dangerousPatterns = [\n      // Script tags\n      /<script[\\s>]/i,\n      /<\\/script>/i,\n\n      // Event handlers (onclick, onload, onerror, etc.)\n      /\\son\\w+\\s*=/i,\n\n      // JavaScript URLs\n      /javascript:/i,\n      /data:text\\/html/i,\n\n      // Foreign objects (can embed HTML)\n      /<foreignObject[\\s>]/i,\n\n      // Embedded iframes\n      /<iframe[\\s>]/i,\n\n      // Embedded objects and embeds\n      /<object[\\s>]/i,\n      /<embed[\\s>]/i,\n\n      // Base64 encoded scripts (common obfuscation technique)\n      /data:image\\/svg\\+xml;base64,[\\w+/]*PHNjcmlwdA/i, // <script in base64\n\n      // XLink href with javascript (deprecated but still dangerous)\n      /xlink:href\\s*=\\s*[\"']javascript:/i,\n\n      // Import statements\n      /@import/i,\n\n      // External resource references that could be dangerous\n      /<!ENTITY/i,\n      /<!DOCTYPE[^>]*\\[/i, // DOCTYPE with internal subset\n\n      // Attempt to use CDATA to hide scripts\n      /<!\\[CDATA\\[[\\s\\S]*<script/i,\n    ]\n\n    for (const pattern of dangerousPatterns) {\n      if (pattern.test(content)) {\n        return false\n      }\n    }\n\n    return true\n  } catch (_error) {\n    return false\n  }\n}\n"],"names":["validateSvg","buffer","content","toString","dangerousPatterns","pattern","test","_error"],"mappings":"AAAA;;;CAGC,GACD,OAAO,SAASA,YAAYC,MAAc;IACxC,IAAI;QACF,MAAMC,UAAUD,OAAOE,QAAQ,CAAC;QAEhC,MAAMC,oBAAoB;YACxB,cAAc;YACd;YACA;YAEA,kDAAkD;YAClD;YAEA,kBAAkB;YAClB;YACA;YAEA,mCAAmC;YACnC;YAEA,mBAAmB;YACnB;YAEA,8BAA8B;YAC9B;YACA;YAEA,wDAAwD;YACxD;YAEA,8DAA8D;YAC9D;YAEA,oBAAoB;YACpB;YAEA,uDAAuD;YACvD;YACA;YAEA,uCAAuC;YACvC;SACD;QAED,KAAK,MAAMC,WAAWD,kBAAmB;YACvC,IAAIC,QAAQC,IAAI,CAACJ,UAAU;gBACzB,OAAO;YACT;QACF;QAEA,OAAO;IACT,EAAE,OAAOK,QAAQ;QACf,OAAO;IACT;AACF"}