You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The removeScriptElement plugin will remove elements if they contain scripts. However, if the element that was removed had the xml:space="preserve" attribute, which applies to the children of the element too, this is unintentionally removed and spacing is no longer preserved.
To Reproduce
Steps to reproduce the behavior:
Optimize the following with SVGO with only the removeScriptElement plugin:
<svgxmlns="http://www.w3.org/2000/svg"viewBox="0 0 100 100">
<ahref="javascript:(() => alert('uwu');)();"xml:space="preserve">
<textx="10"y="35">
this is a test
</text>
</a>
</svg>
Expected behavior
Immediately, I'm thinking that xml:space="preserve" should be forwarded to children of the removed element. For example, in the scenario above, we'd remove the <a> element, and add xml:space="preserve" to the <text> element. In Firefox this resolves the visual difference.
Desktop (please complete the following information):
SVGO Version: main
NodeJs Version: v20
OS: Debian Testing
The text was updated successfully, but these errors were encountered:
Shouldn't this be generalized to all inheritable attributes
I haven't looked into it enough to say, but valid take.
It probably applies to all inheritable attributes, and probably should be handled in a utility that flattens the given node into its parent, which we can use everywhere we do this. We'd have to exclude children that set the same attribute as the removed parent did.
But then the annoying part, which is why I reported the issue instead. When testing xml:space before, it looks to me that while xml:space="preserve" applies to children, most browsers then ignore xml:space="default" from children so it continues to preserve whitespace despite being overridden, and I wanted to investigate this further.
Describe the bug
The
removeScriptElement
plugin will remove elements if they contain scripts. However, if the element that was removed had thexml:space="preserve"
attribute, which applies to the children of the element too, this is unintentionally removed and spacing is no longer preserved.To Reproduce
Steps to reproduce the behavior:
Optimize the following with SVGO with only the
removeScriptElement
plugin:Expected behavior
Immediately, I'm thinking that
xml:space="preserve"
should be forwarded to children of the removed element. For example, in the scenario above, we'd remove the<a>
element, and addxml:space="preserve"
to the<text>
element. In Firefox this resolves the visual difference.Desktop (please complete the following information):
main
The text was updated successfully, but these errors were encountered: