diff --git a/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts b/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts index 17d5b40b1..d22df183e 100644 --- a/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts +++ b/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts @@ -66,4 +66,14 @@ describe("SVG sanitization", () => { const clean = sanitizeSvg(dirty); expect(clean).not.toContain("onbegin"); }); + + it("preserves well-formed SVG with self-closing children", () => { + const icon = ''; + const clean = sanitizeSvg(icon); + expect(clean).toContain(""); + expect(clean).not.toContain(" { // linkedom's DOMParser omits html/body for fragment-only SVG; DOMPurify needs a body root. const wrapped = `${svgText}`; const sanitized = purify.sanitize(wrapped, svgSanitizeOptions); - const svgMatch = sanitized.match(/|\/>)/i); + const svgMatch = sanitized.match(/]*\/>|/i); return svgMatch ? svgMatch[0] : ""; };