github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-05-01 14:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

:spakles: Minor improvements on svg uploading on libraries.

Browse Source 
Mainly reject svgs that have doctype declaration for security reasons.
This commit is contained in:
Andrey Antukh 2021-05-27 12:59:42 +02:00
parent 4d19b87fff
commit 69ea8229ca
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/app/media.clj
View File

@ -183,7 +183,7 @@
(us/assert ::input input)
(let [{:keys [path mtype]} input]
(if (= mtype "image/svg+xml")
(let [info (some-> path slurp svg/pre-process svg/parse get-basic-info-from-svg)]
(let [info (some-> path slurp svg/parse get-basic-info-from-svg)]
(when-not info
(ex/raise :type :validation
:code :invalid-svg-file

2
backend/src/app/rpc/queries/svg.clj
View File

@ -54,6 +54,6 @@
[data]
(cond-> data
(str/includes? data "<!DOCTYPE")
(str/replace #"<\!DOCTYPE[^>]+>" "")))
(str/replace #"<\!DOCTYPE[^>]*>" "")))
(def pre-process strip-doctype)