Sanitize uploaded SVG files

[asteriscos]

Description

This pull request adds sanitization to uploaded SVG custom branding files.

Evidence

Test

Upload file

• Go to Settings / Configuration
• Upload the provided test SVG file
• Verify the script embedded is removed

Sanitize previously uploaded files

• Save the sample SVG file into the custom branding images folder
• Initialize the app
• Verify the script has been removed

Sample SVG file

customization.logo.app.svg

<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
	 width="100px" height="100px" viewBox="0 0 100 100" style="enable-background:new 0 0 100 100;" xml:space="preserve">

  <circle cx="50" cy="50" r="45" fill="green" id="foo" o="foo"/>

  <script>alert(document.domain);</script>

</svg>

Check List

• All tests pass
  • yarn test:jest
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[Tostti]

Test

• Upload file 🟢
• Sanitize previously uploaded files 🟢

[jbiset]

CR: 🟢

Test: 🟢

Upload file 🟢

• Go to Settings / Configuration
• Upload the provided test SVG file
• Verify the script embedded is removed

Evidence

Sanitize previously uploaded files 🟢

• Save the sample SVG file into the custom branding images folder
• Initialize the app
• Verify the script has been removed

Evidence

[Machi3mfl]

CR: ✅
Test: ✅

Removes script tag from svg file when is uploaded via UI

Screen.Recording.2024-05-21.at.15.49.05.mov

Adding script tag inside svg file when the file is already uploaded

The svg file is cleaned after execute the cron job

Screen.Recording.2024-05-21.at.15.49.45.mov

Screen.Recording.2024-05-21.at.15.51.24.mov