fix(orbit): add SVG text escaping, text length limit, and cache headers

Apply security and stability improvements from badge to orbit: escape
XML in text output, limit text to 100 characters, add Cache-Control.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: wontory

apps/web/app/api/orbit/route.ts

@@ -4,7 +4,7 @@ import { resolveSimpleIcon } from '#utils/simple-icon'
 
 export async function GET(request: NextRequest) {
   const { searchParams } = request.nextUrl
-  const text = searchParams.get('text') || ''
+  const text = (searchParams.get('text') || '').slice(0, 100)
   const slugs = searchParams.get('slugs') || ''
 
   const icons = []
@@ -26,6 +26,7 @@ export async function GET(request: NextRequest) {
   return new Response(orbitSvg, {
     headers: {
       'content-type': 'image/svg+xml',
+      'cache-control': 'public, max-age=3600, s-maxage=3600',
     },
   })
 }

packages/orbit/src/index.ts

@@ -11,6 +11,7 @@ import {
   calculateOrbitRadius,
   calculateOuterOrbitIconSize,
   calculateSvgDimensions,
+  escapeXml,
 } from '#utils'
 
 const generateGradientDefs = (): string => `
@@ -59,7 +60,7 @@ const generateTextElement = (
       text-anchor="middle" 
       dominant-baseline="middle" 
       fill="url(#gradient)"
-    >${text}</text>
+    >${escapeXml(text)}</text>
   `
 
 const generateTextContent = (

packages/orbit/src/utils.ts

@@ -61,6 +61,15 @@ const calculateIconSizeMultiplier = (
   orbitIndex: number,
 ): number => baseMultiplier + incrementFactor * (orbitIndex + 1) ** 1.1
 
+const escapeXml = (text: string): string => {
+  return text
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;')
+}
+
 export {
   calculateLargestOrbitRadius,
   calculateOuterOrbitIconSize,
@@ -70,4 +79,5 @@ export {
   calculateOrbitRadius,
   calculateAnimationDuration,
   calculateIconSizeMultiplier,
+  escapeXml,
 }