mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 22:10:34 +00:00
6961767881
Route SVG sanitization through app.media/sanitize-svg, the same local/remote switch the rest of media processing uses. Without :remote-media-processing the existing ad-hoc blocklist filter runs locally; with it enabled, the SVG is posted to media-processor (POST /api/svg/sanitize) and sanitized by DOMPurify's allowlist, which fails closed. When the remote backend is on but the service fails, the upload or import fails instead of silently falling back to the weaker filter. Both entrances go through it: the media upload command and the binfile import (v1, v2, v3). The import job-def now carries the http client and shared keys so it can reach the service. The service creates a fresh jsdom window per sanitization and closes it, because DOMPurify keeps state on its window and reusing one leaks memory in a long-lived process. The XML declaration and DOCTYPE are stripped before parsing. AI-assisted-by: deepseek-v4.1-flash
44 lines
1.3 KiB
JSON
44 lines
1.3 KiB
JSON
{
|
|
"name": "media-processor",
|
|
"version": "1.0.0",
|
|
"description": "Stateless HTTP service for Penpot image and font processing",
|
|
"type": "module",
|
|
"main": "dist/index.js",
|
|
"scripts": {
|
|
"build": "node esbuild.config.mjs",
|
|
"start": "node dist/index.js",
|
|
"start:dev": "tsx --env-file=../backend/scripts/_env src/index.ts",
|
|
"types:check": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"fmt": "prettier --write src/ test/",
|
|
"fmt:check": "prettier --check src/ test/",
|
|
"clean": "rm -rf dist/"
|
|
},
|
|
"packageManager": "pnpm@12.8.1+sha512.f64ba907507f5ceafe06c8d38e6052d0179444580ec1279ddd5bfc11cb48aa8a2644b66598e07e761da84872a9fc57d5f902b87fa49d024198d558612aabbe45",
|
|
"dependencies": {
|
|
"dompurify": "^3.4.16",
|
|
"express": "^5.2.1",
|
|
"jsdom": "^30.1.2",
|
|
"multer": "^2.4.0",
|
|
"p-queue": "^9.3.3",
|
|
"pino": "^10.4.0",
|
|
"pino-loki": "^3.0.0",
|
|
"pino-pretty": "^13.2.0",
|
|
"sharp": "^0.35.5",
|
|
"zod": "^4.6.5"
|
|
},
|
|
"devDependencies": {
|
|
"@types/express": "^5.0.6",
|
|
"@types/jsdom": "^30.0.0",
|
|
"@types/multer": "^2.3.0",
|
|
"@types/node": "^26.6.4",
|
|
"@types/supertest": "^7.2.1",
|
|
"esbuild": "^0.28.2",
|
|
"prettier": "^3.9.9",
|
|
"supertest": "^7.3.1",
|
|
"tsx": "^4.23.15",
|
|
"typescript": "^7.0.2",
|
|
"vitest": "^5.0.3"
|
|
}
|
|
}
|