mirror of
https://github.com/penpot/penpot.git
synced 2026-08-09 14:28:55 +00:00
c4dd04353f
Add sanitize-svg function that removes dangerous elements and attributes: - script tags - foreignObject elements - Event handler attributes (onload, onmouseover, etc.) - javascript: URLs from href/xlink:href attributes Apply sanitization in process-main-image before storing SVG files. AI-assisted-by: mimo-v2.5-pro
209 lines
10 KiB
Clojure
209 lines
10 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS INC Sucursal en España SL
|
|
|
|
(ns backend-tests.media-test
|
|
(:require
|
|
[app.common.exceptions :as ex]
|
|
[app.media :as media]
|
|
[app.media.svg :as svg]
|
|
[backend-tests.helpers :as th]
|
|
[clojure.test :as t]
|
|
[datoteka.fs :as fs]))
|
|
|
|
(t/use-fixtures :once th/state-init)
|
|
|
|
(t/deftest info-jpeg
|
|
(t/testing "info on valid JPEG returns dimensions and mime type"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.jpg")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/jpeg"}})]
|
|
(t/is (pos? (:width info)))
|
|
(t/is (pos? (:height info)))
|
|
(t/is (= "image/jpeg" (:mtype info)))
|
|
(t/is (pos? (:size info)))
|
|
(t/is (some? (:ts info))))))
|
|
|
|
(t/deftest info-png
|
|
(t/testing "info on valid PNG returns dimensions and mime type"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.png")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/png"}})]
|
|
(t/is (pos? (:width info)))
|
|
(t/is (pos? (:height info)))
|
|
(t/is (= "image/png" (:mtype info))))))
|
|
|
|
(t/deftest info-webp
|
|
(t/testing "info on valid WebP returns dimensions and mime type"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.webp")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/webp"}})]
|
|
(t/is (pos? (:width info)))
|
|
(t/is (pos? (:height info)))
|
|
(t/is (= "image/webp" (:mtype info))))))
|
|
|
|
(t/deftest info-svg
|
|
(t/testing "info on valid SVG returns dimensions from viewBox"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample1.svg")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/svg+xml"}})]
|
|
(t/is (pos? (:width info)))
|
|
(t/is (pos? (:height info))))))
|
|
|
|
(t/deftest sanitize-svg-script-tag
|
|
(t/testing "sanitize-svg removes script tags"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><script>alert('xss')</script><rect width=\"50\" height=\"50\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "<script>")))
|
|
(t/is (not (clojure.string/includes? result "alert")))
|
|
(t/is (clojure.string/includes? result "<rect")))))
|
|
|
|
(t/deftest sanitize-svg-event-handlers
|
|
(t/testing "sanitize-svg removes event handler attributes"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\" onload=\"alert('xss')\"><rect width=\"50\" height=\"50\" onmouseover=\"alert('xss')\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "onload")))
|
|
(t/is (not (clojure.string/includes? result "onmouseover")))
|
|
(t/is (not (clojure.string/includes? result "alert")))
|
|
(t/is (clojure.string/includes? result "<rect")))))
|
|
|
|
(t/deftest sanitize-svg-javascript-href
|
|
(t/testing "sanitize-svg removes javascript: URLs from href attributes"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"><a xlink:href=\"javascript:alert('xss')\"><rect width=\"50\" height=\"50\"/></a></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "javascript:")))
|
|
(t/is (not (clojure.string/includes? result "alert")))
|
|
(t/is (clojure.string/includes? result "<a")))))
|
|
|
|
(t/deftest sanitize-svg-foreign-object
|
|
(t/testing "sanitize-svg removes foreignObject elements"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><foreignObject width=\"100\" height=\"100\"><body xmlns=\"http://www.w3.org/1999/xhtml\"><script>alert('xss')</script></body></foreignObject><rect width=\"50\" height=\"50\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "foreignObject")))
|
|
(t/is (not (clojure.string/includes? result "<script>")))
|
|
(t/is (clojure.string/includes? result "<rect")))))
|
|
|
|
(t/deftest sanitize-svg-clean-content
|
|
(t/testing "sanitize-svg preserves clean SVG content"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"50\" height=\"50\" fill=\"red\"/><circle cx=\"75\" cy=\"75\" r=\"20\" fill=\"blue\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (clojure.string/includes? result "<rect"))
|
|
(t/is (clojure.string/includes? result "<circle"))
|
|
(t/is (or (clojure.string/includes? result "fill=\"red\"")
|
|
(clojure.string/includes? result "fill='red'")))
|
|
(t/is (or (clojure.string/includes? result "fill=\"blue\"")
|
|
(clojure.string/includes? result "fill='blue'"))))))
|
|
|
|
(t/deftest sanitize-svg-invalid-svg-rejected
|
|
(t/testing "sanitize-svg rejects malformed SVG input"
|
|
(let [svg "<svg><not-closed>"]
|
|
(t/is (thrown-with-msg? Exception #"SVG parsing failed during sanitization"
|
|
(svg/sanitize-svg svg))))))
|
|
|
|
(t/deftest sanitize-svg-preserves-xlink
|
|
(t/testing "sanitize-svg preserves legitimate xlink:href attributes"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"><use xlink:href=\"#icon\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (clojure.string/includes? result "xlink:href"))
|
|
(t/is (clojure.string/includes? result "#icon")))))
|
|
|
|
(t/deftest sanitize-svg-javascript-href-whitespace
|
|
(t/testing "sanitize-svg catches javascript: URLs with leading whitespace"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><a href=\" javascript:alert('xss')\"><rect width=\"50\" height=\"50\"/></a></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "javascript:")))
|
|
(t/is (not (clojure.string/includes? result "alert")))
|
|
(t/is (clojure.string/includes? result "<a")))))
|
|
|
|
(t/deftest sanitize-svg-nested-script
|
|
(t/testing "sanitize-svg removes script tags from nested elements"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><g><script>alert('xss')</script></g></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "<script")))
|
|
(t/is (not (clojure.string/includes? result "alert")))
|
|
(t/is (clojure.string/includes? result "<g")))))
|
|
|
|
(t/deftest sanitize-svg-smil-bypass
|
|
(t/testing "sanitize-svg removes SMIL animation elements that can set on* attrs"
|
|
(let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"100\" height=\"100\" id=\"r\"/><set attributeName=\"onmouseover\" to=\"alert('xss')\" xlink:href=\"#r\" begin=\"0s\"/></svg>"
|
|
result (svg/sanitize-svg svg)]
|
|
(t/is (not (clojure.string/includes? result "<set")))
|
|
(t/is (not (clojure.string/includes? result "onmouseover")))
|
|
(t/is (clojure.string/includes? result "<rect")))))
|
|
|
|
(t/deftest info-invalid-image
|
|
(t/testing "info on invalid image raises error"
|
|
(let [path (fs/create-tempfile :prefix "penpot-test-" :suffix ".jpg")]
|
|
;; Write garbage data
|
|
(spit (str path) "not an image")
|
|
(try
|
|
(media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/jpeg"}})
|
|
(t/is false "should have thrown")
|
|
(catch Exception e
|
|
(let [data (ex-data e)]
|
|
(t/is (= :validation (:type data)))
|
|
(t/is (= :invalid-image (:code data)))))
|
|
(finally
|
|
(fs/delete path))))))
|
|
|
|
(t/deftest generic-thumbnail
|
|
(t/testing "generic-thumbnail produces a file of expected format"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.jpg")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/jpeg"}})
|
|
thumb (media/run th/*system* {:cmd :generic-thumbnail
|
|
:input info
|
|
:format :jpeg
|
|
:quality 80
|
|
:width 200
|
|
:height 200})]
|
|
(t/is (some? (:data thumb)))
|
|
(t/is (pos? (:size thumb)))
|
|
(t/is (= :jpeg (:format thumb)))
|
|
(t/is (= "image/jpeg" (:mtype thumb)))
|
|
;; Verify the thumbnail file exists
|
|
(t/is (fs/exists? (:data thumb))))))
|
|
|
|
(t/deftest profile-thumbnail
|
|
(t/testing "profile-thumbnail produces a center-cropped file"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.jpg")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/jpeg"}})
|
|
thumb (media/run th/*system* {:cmd :profile-thumbnail
|
|
:input info
|
|
:format :jpeg
|
|
:quality 85
|
|
:width 128
|
|
:height 128})]
|
|
(t/is (some? (:data thumb)))
|
|
(t/is (pos? (:size thumb)))
|
|
(t/is (= :jpeg (:format thumb)))
|
|
(t/is (= "image/jpeg" (:mtype thumb)))
|
|
;; Verify the thumbnail file exists
|
|
(t/is (fs/exists? (:data thumb))))))
|
|
|
|
(t/deftest generic-thumbnail-webp
|
|
(t/testing "generic-thumbnail can produce WebP format"
|
|
(let [path (th/tempfile "backend_tests/test_files/sample.jpg")
|
|
info (media/run th/*system* {:cmd :info
|
|
:input {:path path
|
|
:mtype "image/jpeg"}})
|
|
thumb (media/run th/*system* {:cmd :generic-thumbnail
|
|
:input info
|
|
:format :webp
|
|
:quality 80
|
|
:width 200
|
|
:height 200})]
|
|
(t/is (= :webp (:format thumb)))
|
|
(t/is (= "image/webp" (:mtype thumb))))))
|