{"version":3,"sources":["../src/utils/sanitizeHtml.ts"],"sourcesContent":["/**\n * Minimal HTML sanitizer — strips <script>, event handlers, javascript: URLs, and other\n * dangerous constructs. Consumers who need full DOMPurify behavior can pass a custom\n * `sanitize` prop to ReadOnlyRichText.\n *\n * Shared across all adapter packages via the `@formosaic/core/adapter-utils` subpath export.\n */\nconst UNSAFE_TAG_PAIR = /<(script|iframe|object|embed|style|noscript)[^>]*>[\\s\\S]*?<\\/\\1\\s*>/gi;\nconst UNSAFE_TAG_SELF = /<(script|iframe|object|embed|link|style|meta|base)[^>]*\\/?>(?!<\\/\\1)/gi;\nconst EVENT_HANDLERS = /\\son[a-z]+\\s*=\\s*(?:\"[^\"]*\"|'[^']*'|[^\\s>]+)/gi;\nconst JS_URLS = /(href|src|xlink:href|action|formaction)\\s*=\\s*(?:\"\\s*javascript:[^\"]*\"|'\\s*javascript:[^']*'|javascript:[^\\s>]*)/gi;\n\nexport function sanitizeHtml(html: string): string {\n  if (typeof html !== \"string\") return \"\";\n  return html\n    .replace(UNSAFE_TAG_PAIR, \"\")\n    .replace(UNSAFE_TAG_SELF, \"\")\n    .replace(EVENT_HANDLERS, \"\")\n    .replace(JS_URLS, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAOA,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,UAAU;AAET,SAAS,aAAa,MAAsB;AACjD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,SAAO,KACJ,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,SAAS,EAAE;AACxB;","names":[]}