Utils

1import { type ClassValue, clsx } from 'clsx'
2import { twMerge } from 'tailwind-merge'
3 
4export function cn(...inputs: ClassValue[]) {
5  return twMerge(clsx(inputs))
6}
7 
8const SAFE_URL_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:'])
9 
10/** Sanitize a URL to prevent javascript: protocol injection. Returns '#' for unsafe values. */
11export function safeHref(url: string | undefined): string {
12  if (!url) return '#'
13  if (url.startsWith('/') || url.startsWith('#')) return url
14  try {
15    const parsed = new URL(url, 'https://placeholder.invalid')
16    return SAFE_URL_PROTOCOLS.has(parsed.protocol) ? url : '#'
17  } catch {
18    return '#'
19  }
20}
21 
22/** Sanitize a CSS value by stripping characters that could break out of a CSS declaration. */
23export function sanitizeCssValue(value: string): string {
24  return value.replace(/[{}<>;"'\\]/g, '')
25}