From b3b2d5a02267d1b55c3e1d4faccd9f87bf182c5a Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Fri, 7 Aug 2026 21:00:55 +0200
Subject: [PATCH] fix: SVG regex prefers </svg> terminator, add self-closing
 children test

Use greedy <svg>...</svg> match preferring closing tag over inner />
to prevent truncation at first self-closing child element.
Self-closing root <svg .../> handled as separate alternative.
Added test with <path/> + <circle/> children asserting well-formed output.
---
 apps/nextjs/src/app/api/user-medias/sanitize.spec.ts | 10 ++++++++++
 apps/nextjs/src/app/api/user-medias/svg-purify.ts    |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts b/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts
index 17d5b40b1..d22df183e 100644
--- a/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts
+++ b/apps/nextjs/src/app/api/user-medias/sanitize.spec.ts
@@ -66,4 +66,14 @@ describe("SVG sanitization", () => {
     const clean = sanitizeSvg(dirty);
     expect(clean).not.toContain("onbegin");
   });
+
+  it("preserves well-formed SVG with self-closing children", () => {
+    const icon = '<svg viewBox="0 0 24 24"><path d="M12 2L2 22h20Z" fill="currentColor"/><circle cx="12" cy="8" r="2"/></svg>';
+    const clean = sanitizeSvg(icon);
+    expect(clean).toContain("<path");
+    expect(clean).toContain("<circle");
+    expect(clean).toContain("</svg>");
+    expect(clean).not.toContain("<html");
+    expect(clean).not.toContain("<body");
+  });
 });
diff --git a/apps/nextjs/src/app/api/user-medias/svg-purify.ts b/apps/nextjs/src/app/api/user-medias/svg-purify.ts
index c5237538a..ae50b5494 100644
--- a/apps/nextjs/src/app/api/user-medias/svg-purify.ts
+++ b/apps/nextjs/src/app/api/user-medias/svg-purify.ts
@@ -86,7 +86,7 @@ export const sanitizeSvg = (svgText: string) => {
   // linkedom's DOMParser omits html/body for fragment-only SVG; DOMPurify needs a body root.
   const wrapped = `<html><body>${svgText}</body></html>`;
   const sanitized = purify.sanitize(wrapped, svgSanitizeOptions);
-  const svgMatch = sanitized.match(/<svg[\s\S]*?(?:<\/svg>|\/>)/i);
+  const svgMatch = sanitized.match(/<svg[^>]*\/>|<svg[\s\S]*<\/svg>/i);
   return svgMatch ? svgMatch[0] : "";
 };