Repository navigation
Harden handling of symbol SVG from outside the app - #1015
Merged
Merged
Conversation
Replace the pattern check for symbol SVGs from outside the app with a strict parser that keeps only known drawing elements and attributes and writes the SVG back from the parsed tree (js/core/svg-veilig.js). - online library collections, imported symbol groups and files, linework catalog previews and edited symbol types go through it on entry, and stored groups and symbol types are cleaned once at startup - thumbnails of non-built-in symbols render as <img> data URLs instead of inline markup - the symbol type editor and extension palette icons only receive cleaned markup without <style> - shipped libraries pass through unchanged
Link URLs in release notes end up in a double-quoted href attribute, so quotes are now escaped along with the other markup characters. The text editor overlays escape quotes the same way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stricter handling of symbol SVG that does not ship with the app, and quote escaping in two generated-markup paths.
What changes
js/core/svg-veilig.js: SVG from outside the app (online library collections, imported and custom symbol groups, edited symbol types, catalogue previews, extension palette icons, the symbol type editor) goes through an allowlist of drawing elements and attributes with a strict XML parse. Anything outside the list is removed, and markup that does not parse cleanly is refused. Previously stored collections and groups are cleaned once at start-up.<img>data URLs instead of inline markup."in generated attributes.The bundled libraries (155 symbols) and all 512 SVGs of the online library pass through unchanged.
Verification
node --test js/core/svg-veilig.test.mjs(13 tests, including a corpus of malformed and unexpected inputs) andjs/help/release-notes-markdown.test.mjsscripts/test-symbol-library-online.mjsagainst a checkout of the library: 789 checks, 0 failuresnode scripts/draai-unit-tests.mjs: 8072 tests, 0 failnpx vite build,npm run build:hosted: exit 0Not verified
🤖 Generated with Claude Code