mirror of https://github.com/penpot/penpot.git synced 2026-08-31 17:19:11 +00:00

🐛 Fix linear gradients in SVG text exports (#11272 )

* 🐛 Use gradient type instead of export type in SVG renderer

data->gradient-def was comparing the render `type` parameter (:svg,
:png, :pdf) against "linear" to decide between linearGradient and
radialGradient elements. Since the export type is never "linear",
the comparison always fell through to radialGradient, causing all
linear gradients to be exported as radial in SVG output.

Read the gradient type from the data map instead:
(get-in data ["gradient" "type"])

Closes #5972

* 🐛 Add SVG gradient export regression test

Extract SVG gradient definition generation from the renderer so it can
be tested directly. Add exporter test build wiring and cover both
linear and radial gradient output.

AI-assisted-by: gpt-5.6-luna

* ✨ Standardize exporter testing workflow

Align exporter scripts with the frontend testing pattern. Add a
dedicated GitHub Actions workflow and document the canonical exporter
commands in Serena memories.

AI-assisted-by: gpt-5.6-luna

* ✨ Add focused exporter test execution

Mirror frontend test-runner behavior for focused namespaces and test
vars. Support --focus, --log-level, and --help, and document the
commands.

AI-assisted-by: gpt-5.6-luna

* 🐛 Replace shell exec with execFile in exporter

Replace child_process.exec with execFile to eliminate shell
interpretation. Add hex color validation in exporter and frontend
to reject malformed input before command construction.

This fixes GHSA-4f36-m4hj-cv86 (CVSS 9.9 Critical), an authenticated
OS command injection vulnerability where malicious fill-color values
could execute arbitrary commands in the exporter container.

Defense in depth:
- Layer 1: execFile passes arguments directly without shell parsing
- Layer 2: Exporter validates colors with strict hex regex
- Layer 3: Frontend filters invalid colors before DOM emission

All three independent reporters' attack vectors are addressed:
- Quote breakout (lyhtheori)
- Command substitution (B1gN0Se)
- Path traversal (KimiSecurityTeam)

AI-assisted-by: qwen3.7-plus

* 🐛 Use existing hex-color-string? and fix test path mismatch

Address code review feedback:

- Replace duplicated hex-color-rx and valid-hex-color? with existing
  hex-color-string? from app.common.types.color
- Fix RCE test to use marker path in payload instead of hardcoded /tmp/pwned

AI-assisted-by: qwen3.7-plus

---------

Co-authored-by: Sumit Ridhal <sridhal@redhat.com>

2026-08-19 13:29:04 +02:00

1.2 KiB

Raw Blame History

Exporter Testing

READ mem:testing first.
Tests use cljs.test and live under exporter/test/exporter_tests/.
Register every test namespace in exporter-tests.runner.
From exporter/: pnpm run build:test builds the Node test bundle without running tests.
From exporter/: pnpm run test builds and runs tests with full output.
From exporter/: pnpm run test:quiet builds and runs tests with reduced build output.
After build:test, reuse the compiled bundle with node target/tests/test.js.
For iterative focused runs, build once and reuse the compiled bundle.
Focus a test namespace with node target/tests/test.js --focus exporter-tests.renderer-svg-test.
Focus a test var with node target/tests/test.js --focus exporter-tests.renderer-svg-test/creates-the-correct-gradient-element.
Set app log level by appending --log-level warn (or trace|debug|info|warn|error).
test:quiet accepts forwarded options but rebuilds the bundle; prefer the direct runner after build:test for focused runs.
From exporter/: pnpm run check-fmt:clj checks ClojureScript formatting.
From exporter/: pnpm run lint:clj runs ClojureScript linting.

1.2 KiB Raw Blame History

Exporter Testing

1.2 KiB

Raw Blame History