( function( $ ) {
/**
* Sanitize icon markup before injecting it into the DOM.
*
* The nav-menu toggle/close icons are read from data-* attributes and
* rendered as HTML. Only Font Awesome and inline SVG icons are
* legitimate here, so every other element — and every event handler or
* URL-bearing attribute — is stripped to prevent DOM-based XSS.
*
* Parsing happens inside a , whose content is inert: images do
* not load and scripts do not run, so no payload fires during sanitization.
*
* @since 2.9.2
* @param {string} markup Raw icon markup from a data attribute.
* @return {string} Sanitized markup safe to pass to jQuery .html().
*/
function hfe_sanitize_icon_html( markup ) {
if ( 'string' !== typeof markup || '' === markup ) {
return '';
}
// Icon-only elements: basic shapes plus the paint/structural elements
// (gradients, clip paths, masks, patterns, markers) that multi-colour
// SVG icons rely on. All of these are non-scriptable and hold no text
// content. Deliberately excludes elements with special parsing
// (RCDATA/RAWTEXT such as