Penpot/penpot
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-01-24 07:29:08 -05:00
Code Issues Activity

:spakles: Minor improvements on svg uploading on libraries.

Browse source 
Mainly reject svgs that have doctype declaration for security reasons.
This commit is contained in:
Andrey Antukh 2021-05-27 12:59:42 +02:00
parent 4d19b87fff
commit 69ea8229ca
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
backend/src/app/media.clj
View file

@ -183,7 +183,7 @@
(us/assert ::input input) (us/assert ::input input)
(let [{:keys [path mtype]} input] (let [{:keys [path mtype]} input]
(if (= mtype "image/svg+xml") (if (= mtype "image/svg+xml")
(let [info (some-> path slurp svg/pre-process svg/parse get-basic-info-from-svg)] (let [info (some-> path slurp svg/parse get-basic-info-from-svg)]
(when-not info (when-not info
(ex/raise :type :validation (ex/raise :type :validation
:code :invalid-svg-file :code :invalid-svg-file

2
backend/src/app/rpc/queries/svg.clj
View file

@ -54,6 +54,6 @@
[data] [data]
(cond-> data (cond-> data
(str/includes? data "<!DOCTYPE") (str/includes? data "<!DOCTYPE")
(str/replace #"<\!DOCTYPE[^>]+>" ""))) (str/replace #"<\!DOCTYPE[^>]*>" "")))
(def pre-process strip-doctype) (def pre-process strip-doctype)