17 lines
860 B
JavaScript
17 lines
860 B
JavaScript
// lib/icons/sanitize.js
|
|
// Focused SVG sanitizer for owner-uploaded icons. NOT a general-purpose
|
|
// sanitizer — it removes the script/handler/foreignObject/js-uri vectors that
|
|
// matter for inline-rendered icons. (Owner-only upload behind CF Access.)
|
|
export function sanitizeSvg(input) {
|
|
let s = Buffer.isBuffer(input) ? input.toString('utf8') : String(input);
|
|
s = s.replace(/<script[\s\S]*?<\/script>/gi, '');
|
|
s = s.replace(/<foreignObject[\s\S]*?<\/foreignObject>/gi, '');
|
|
s = s.replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '');
|
|
s = s.replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '');
|
|
// Unquoted handlers, e.g. <svg onload=alert(1)>. Value runs until whitespace,
|
|
// quote, or the tag's closing > / />.
|
|
s = s.replace(/\son[a-z]+\s*=\s*[^\s">]+/gi, '');
|
|
s = s.replace(/(href|xlink:href)\s*=\s*("|')\s*javascript:[^"']*\2/gi, '$1=$2#$2');
|
|
return s;
|
|
}
|