eessppeelllloo/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-12-05 15:29:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

disallow xref/xhref in SVGs

Browse Source 
Signed-off-by: Andy Miller <rhuk@mac.com>
This commit is contained in:
Andy Miller
2025-11-24 21:04:44 +00:00
parent 48343d7714
commit 04c6bdf287
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
system/src/Grav/Common/Security.php
View File

@@ -51,6 +51,7 @@ class Security
{ {
if (Grav::instance()['config']->get('security.sanitize_svg')) { if (Grav::instance()['config']->get('security.sanitize_svg')) {
$sanitizer = new DOMSanitizer(DOMSanitizer::SVG); $sanitizer = new DOMSanitizer(DOMSanitizer::SVG);
$sanitizer->addDisallowedAttributes(['href', 'xlink:href']);
$sanitized = $sanitizer->sanitize($svg); $sanitized = $sanitizer->sanitize($svg);
if (is_string($sanitized)) { if (is_string($sanitized)) {
$svg = $sanitized; $svg = $sanitized;
@@ -70,6 +71,7 @@ class Security
{ {
if (file_exists($file) && Grav::instance()['config']->get('security.sanitize_svg')) { if (file_exists($file) && Grav::instance()['config']->get('security.sanitize_svg')) {
$sanitizer = new DOMSanitizer(DOMSanitizer::SVG); $sanitizer = new DOMSanitizer(DOMSanitizer::SVG);
$sanitizer->addDisallowedAttributes(['href', 'xlink:href']);
$original_svg = file_get_contents($file); $original_svg = file_get_contents($file);
$clean_svg = $sanitizer->sanitize($original_svg); $clean_svg = $sanitizer->sanitize($original_svg);