cleanMarkupfunction

SVG markup with what could run or fetch taken out: scripts, foreignObject, frames, animation elements and styles, every on… handler, and any href that is not a picture or a #fragment of the drawing itself. Anything else is kept as it was written. This is a guard for markup that came from a page's own code, not a sanitiser for strangers' files: never hand it what a visitor typed.

import { cleanMarkup } from "@johnmorrisdotca/toranpu/card-faces";

function cleanMarkup(markup: unknown): string

import { cleanMarkup } from "@johnmorrisdotca/toranpu/card-faces";

console.log(cleanMarkup(`<svg><script>alert(1)</script><circle cx="5" cy="5" r="2"/></svg>`));

<svg><circle cx="5" cy="5" r="2"/></svg>