[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_163":164,"_165":166},"routes/_app.x.$handle.$name",{"_101":100,"_38":50,"_109":91,"_33":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_26":-5,"_121":-5,"_122":-5,"_123":54,"_124":125,"_126":31,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_48":49,"_38":50,"_43":51,"_52":-5,"_53":54,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":31,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":76,"_77":76,"_78":79,"_80":79,"_81":79,"_82":76,"_83":76,"_84":85,"_86":87,"_88":89,"_90":54},"version",22,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","6c64ae72-1add-4770-8374-00dc52ed229a","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":42,"_43":44,"_45":14,"_46":47,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",true,"deletedHere","path","debug.ts","latestPath","fileId","64d5c5d0-9e11-11f1-a3a5-1607ee4eb77e","name","fileType","script","content","import * as linkedom from \"npm:linkedom\";\n\nconst { DOMParser } = linkedom as any;\n\nconst raw = ``;\n\nconst doc = new DOMParser().parseFromString(raw, \"application/xml\");\nconst root = doc.documentElement;\n\nconsole.log(\"toString():\", root.toString());\n\n// Rebuild cleanly:\nconst copy = doc.createElementNS(\"http://www.w3.org/2000/svg\", \"svg\");\nfor (const a of Array.from(root.attributes)) copy.setAttribute(a.name, a.value);\nfor (const c of Array.from(root.children)) {\n const cc = doc.createElementNS(\"http://www.w3.org/2000/svg\", c.tagName);\n for (const a of Array.from(c.attributes)) cc.setAttribute(a.name, a.value);\n copy.appendChild(cc);\n}\nconsole.log(\"clean toString():\", copy.toString());\n","createdAt",["D",1787393408188],"branchVersion","branchId","11e8aa49-9adc-4367-b80a-12165a26a9bf","id","89b8674c-29a2-42c5-9697-75f5e30658bb","svg-markup-to-img",["D",1787391542074],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","receive raw SVG markup, then respond image/svg+xml","imageUrl","1503fe37-2d29-431d-9c4d-04c28bef7179","pinnedFileId","4eecd794-9e0d-11f1-a085-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1a4ba75e-50a6-4110-b735-f44a06c525c9","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_19":61,"_105":106,"_107":54},"branch",{"_13":14,"_38":91,"_48":47,"_92":49,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":50,"_99":100},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","vilmid","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycTNtNDhUSFpRcE10bEZqVXlYbFJRRUdqWVYifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_48":49,"_38":50,"_43":159,"_52":-5,"_53":54,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":31,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":76,"_77":76,"_78":79,"_80":79,"_81":79,"_82":76,"_83":76,"_84":160,"_86":161,"_88":162,"_90":54},"tree",[154],"files",[154],"counts",{"_143":68,"_144":145,"_146":68,"_147":148,"_149":150},"contents",[131],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_48":132,"_38":133,"_36":63,"_134":-5,"_46":47,"_45":135,"_136":31,"_43":137,"_13":138,"_39":139,"_41":140,"_30":54,"_141":50,"_33":142},"6dffb0f3-ad53-4413-a947-6ac3bfb590df","main.ts","parentId",21,"latest",["D",1787393398554],14,"http","import * as linkedom from \"npm:linkedom\";\n\nconst { DOMParser } = linkedom as {\n DOMParser: typeof globalThis.DOMParser;\n};\n\n// SVG passthrough API. Parses, sanitizes and re-serializes SVG markup so it can\n// be safely embedded cross-origin as an image.\n//\n// GET /api/to-svg?svg=%3Csvg%3E...%3C%2Fsvg%3E\n// `svg` is the raw SVG markup, URL-encoded.\n// -> Returns the sanitized SVG as `image/svg+xml`.\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n\n const cors = {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-methods\": \"GET, OPTIONS\",\n \"access-control-allow-headers\": \"content-type\",\n };\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors });\n }\n\n if (url.pathname === \"/health\") {\n return json({ status: \"online\" }, 200, cors);\n }\n\n if (url.pathname === \"/api/to-svg\" && req.method === \"GET\") {\n const svg = url.searchParams.get(\"svg\") ?? \"\";\n if (!/^\\s*(<\\?xml[^>]*\\?>)?\\s*(]*>)?\\s*<\\s*(svg|!DOCTYPE|\\?xml)/im\n .test(svg)) {\n return json({ error: \"Query param `svg` does not look like SVG markup.\" }, 400, cors);\n }\n\n const clean = sanitizeSvg(svg);\n if (clean === null) {\n return json(\n { error: \"SVG failed to parse or was fully removed by sanitization.\" },\n 400,\n cors,\n );\n }\n\n return new Response(clean, {\n status: 200,\n headers: {\n \"content-type\": \"image/svg+xml; charset=utf-8\",\n ...cors,\n },\n });\n }\n\n return json({ error: \"Not found. Try GET /health or GET /api/to-svg?svg=...\" }, 404, cors);\n}\n\n/** Tags that can execute code or pull in external content. */\nconst FORBIDDEN_TAGS = new Set([\n \"script\",\n \"foreignobject\", // can smuggle in arbitrary HTML\n \"use\", // href can reference external resources\n \"set\", // can set animation attributeValues (code execution vectors)\n \"animate\", // driven by attribute values\n \"animatecolor\",\n \"animatemotion\",\n \"animatetransform\",\n]);\n\nconst SVG_NS = \"http://www.w3.org/2000/svg\";\n\n/**\n * Parse the SVG, drop forbidden elements and unsafe attributes, then\n * re-serialize only the whitelisted tree. Returns null if it can't.\n */\nfunction sanitizeSvg(raw: string): string | null {\n let doc: Document;\n try {\n doc = new DOMParser().parseFromString(raw, \"application/xml\");\n } catch {\n return null;\n }\n const root = doc?.documentElement;\n if (!root || root.nodeName.toLowerCase() !== \"svg\") return null;\n\n const safe = cleanElement(root, doc);\n if (!safe || safe.childNodes.length === 0 && safe.attributes.length === 0) return null;\n\n try {\n return safe.toString();\n } catch {\n return null;\n }\n}\n\n/** Recursively copy `el`, skipping forbidden nodes and unsafe attributes. */\nfunction cleanElement(el: Element, doc: Document): Element | null {\n const name = el.tagName.toLowerCase();\n if (FORBIDDEN_TAGS.has(name)) return null;\n\n const copy = doc.createElementNS(el.namespaceURI || SVG_NS, name);\n for (const attr of Array.from(el.attributes)) {\n if (isUnsafeAttr(attr.name, attr.value)) continue;\n try {\n copy.setAttribute(attr.name, attr.value);\n } catch {\n /* skip attributes that fail to set */\n }\n }\n for (const child of Array.from(el.childNodes)) {\n if (child.nodeType === 3 /* text */) {\n const t = child.textContent ?? \"\";\n copy.appendChild(doc.createTextNode(t));\n } else if (child.nodeType === 1 /* element */) {\n const cleaned = cleanElement(child as Element, doc);\n if (cleaned) copy.appendChild(cleaned);\n }\n // Comments and processing instructions are intentionally dropped.\n }\n return copy;\n}\n\nconst EVENT_ATTR = /^on/i;\nconst URL_ATTRS = new Set([\"href\", \"xlink:href\", \"formaction\", \"action\", \"src\", \"begin\"]);\nconst BAD_CSS = /javascript:|expression\\s*\\(|@import|behavior\\s*:/i;\n\nfunction isUnsafeAttr(name: string, value: string): boolean {\n const lname = name.toLowerCase();\n const lvalue = value.toLowerCase();\n\n // Any event-handler attribute (onerror, onload, onclick, ...) is forbidden.\n if (EVENT_ATTR.test(lname)) return true;\n\n // URL-like attributes may be empty, a same-document fragment, or a\n // script-free data:image/svg+xml URI. Everything else is dropped.\n if (URL_ATTRS.has(lname)) {\n if (!lvalue || lvalue.startsWith(\"#\")) return false;\n if (lvalue.startsWith(\"data:image/svg+xml\")) {\n let decoded: string;\n try {\n decoded = decodeURIComponent(value);\n } catch {\n return true;\n }\n return /<\\s*script|on\\w+\\s*=/i.test(decoded);\n }\n return true;\n }\n\n // Drop CSS that can smuggle in code (style attribute /

Diff · v22