Skip to content

Commit 6ee9fe5

Browse files
sapksapk
committed
backup
1 parent c6278cf commit 6ee9fe5

File tree

2 files changed

+56
-1
lines changed

2 files changed

+56
-1
lines changed

‎modules/util/svg/svg.go

+8-1
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,16 @@ func MinifySVG(svgData io.Reader) (*bytes.Buffer, error) {
2727
func SanitizeSVG(svgData io.Reader) *bytes.Buffer {
2828
p := bluemonday.NewPolicy()
2929
p.AllowElements("svg", "title", "path", "desc", "g")
30-
p.AllowAttrs("id", "viewbox", "role", "aria-labelledby").OnElements("svg")
30+
p.AllowAttrs("id", "viewbox", "role", "aria-labelledby", "xmlns", "xmlns:xlink", "xml:space").OnElements("svg")
3131
p.AllowAttrs("id").OnElements("title", "desc")
3232
p.AllowAttrs("id", "data-name", "class", "aria-label").OnElements("g")
3333
p.AllowAttrs("id", "data-name", "class", "d", "transform", "aria-haspopup").OnElements("path")
34+
p.AllowAttrs("x", "y", "width", "height").OnElements("rect")
35+
36+
//var invalidID = regexp.MustCompile(`((http|ftp)s?)|(url *\( *' *//)`)
37+
//var validID = regexp.MustCompile(`(?!((http|ftp)s?)|(url *\( *' *//))`) //not supported
38+
//p.AllowAttrs("fill").Matching(regexp.MustCompile(`((http|ftp)s?)|(url *\( *' *//)`)).OnElements("rect") //TODO match opposite
39+
40+
p.SkipElementsContent("this", "script")
3441
return p.SanitizeReader(svgData)
3542
}

‎modules/util/svg/svg_test.go

+48
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,54 @@ func TestSanitizeSVG(t *testing.T) {
132132
</g>
133133
</svg>`,
134134
},
135+
{
136+
name: "badXmlTestOne",
137+
input: `<?xml version="1.0" encoding="utf-8"?>
138+
<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
139+
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
140+
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
141+
width="600px" height="600px" viewBox="0 0 600 600" enable-background="new 0 0 600 600" xml:space="preserve">
142+
<line onload="alert(2)" fill="none" stroke="#000000" stroke-miterlimit="10" x1="119" y1="84.5" x2="454" y2="84.5"/>
143+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="111.212" y1="102.852" x2="112.032" y2="476.623"/>
144+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="198.917" y1="510.229" x2="486.622" y2="501.213">
145+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="484.163" y1="442.196" x2="89.901" y2="60.229"/>
146+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="101.376" y1="478.262" x2="443.18" y2="75.803"/>
147+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="457.114" y1="126.623" x2="458.753" y2="363.508"/>
148+
<this>shouldn't be here</this>
149+
<script>alert(1);</script>
150+
<line fill="none" stroke="#000000" stroke-miterlimit="10" x1="541.54" y1="299.573" x2="543.179" y2="536.458"/>
151+
</svg>
152+
`,
153+
//want: ``,
154+
want: `<svg id="Layer_1" viewbox="0 0 600 600"/>`,
155+
},
156+
{
157+
name: "externalTest",
158+
input: `<?xml version="1.0" encoding="utf-8" ?>
159+
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
160+
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve">
161+
<rect fill="url('http://example.com/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
162+
<rect fill="url('https://example.com/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
163+
<rect fill=" url( ' https://example.com/benis.svg ' ) " x="0" y="0" width="1000" height="1000"></rect>
164+
<rect fill="url('ftp://192.168.2.1/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
165+
<rect fill="url('//example.com/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
166+
<rect fill="url('/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
167+
<rect fill="url('#benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
168+
</svg>
169+
`,
170+
//want: ``,
171+
want: `<?xml version="1.0" encoding="utf-8" ?>
172+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve">
173+
<rect x="0" y="0" width="1000" height="1000"></rect>
174+
<rect x="0" y="0" width="1000" height="1000"></rect>
175+
<rect x="0" y="0" width="1000" height="1000"></rect>
176+
<rect x="0" y="0" width="1000" height="1000"></rect>
177+
<rect x="0" y="0" width="1000" height="1000"></rect>
178+
<rect fill="url('/benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
179+
<rect fill="url('#benis.svg')" x="0" y="0" width="1000" height="1000"></rect>
180+
</svg>
181+
`,
182+
},
135183
}
136184
for _, tt := range tests {
137185
t.Run(tt.name, func(t *testing.T) {

0 commit comments

Comments
 (0)