decidim-dev 0.31.7 → 0.31.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/app/controllers/decidim/dev/dummy_resources_controller.rb +2 -0
- data/config/locales/eu.yml +6 -6
- data/config/locales/gl.yml +15 -1
- data/config/rubocop/decidim-linters/configuration.yml +40 -0
- data/config/rubocop/rspec/configuration.yml +1 -0
- data/lib/decidim/dev/assets/empty_file.png +0 -0
- data/lib/decidim/dev/assets/malformed_svg_unclosed_element.svg +7 -0
- data/lib/decidim/dev/assets/malicious_svg_animation.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_animation_attribute_names.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_animation_fill.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_animation_style.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_animation_values.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_attributename_case.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_backslash_reference.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_css_backslash_url.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_css_comment_in_url.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_css_image_set.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_css_image_set_nested_parentheses.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_cursor.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_cursor_attribute.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_data_uri_declared_encoding.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_data_uri_deep_nested.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_data_uri_leading_space.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_data_uri_nested.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_data_uri_parameter.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_entity.svg +5 -0
- data/lib/decidim/dev/assets/malicious_svg_entity_parameter.svg +7 -0
- data/lib/decidim/dev/assets/malicious_svg_external_animation.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_external_animation_missing_target.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_external_animation_target.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_external_feimage.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_external_image.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_external_use.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_fill_external_reference.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_foreign_object.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_handler.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_marker_external_reference.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_mask_attribute.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_script.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_style_comment_string.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_style_import.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_style_import_string.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_style_url_escape.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_style_url_string.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_stylesheet_pi.svg +1 -0
- data/lib/decidim/dev/assets/malicious_svg_uri.svg +1 -0
- data/lib/decidim/dev/assets/spoofed_image.png +0 -0
- data/lib/decidim/dev/assets/spoofed_image_binary.png +1 -0
- data/lib/decidim/dev/assets/spoofed_image_html.png +5 -0
- data/lib/decidim/dev/assets/spoofed_svg_xml.svg +2 -0
- data/lib/decidim/dev/assets/test.avif +0 -0
- data/lib/decidim/dev/assets/test.gif +0 -0
- data/lib/decidim/dev/assets/test.heic +0 -0
- data/lib/decidim/dev/assets/test.svg +1 -0
- data/lib/decidim/dev/assets/test_animation.svg +1 -0
- data/lib/decidim/dev/assets/test_animation_link.svg +7 -0
- data/lib/decidim/dev/assets/test_animation_presentation_reference.svg +8 -0
- data/lib/decidim/dev/assets/test_complex.svg +12 -0
- data/lib/decidim/dev/assets/test_css_references.svg +14 -0
- data/lib/decidim/dev/assets/test_data_uri_declared_encoding.svg +5 -0
- data/lib/decidim/dev/assets/test_entity_in_comment.svg +8 -0
- data/lib/decidim/dev/assets/test_entity_in_processing_instruction.svg +7 -0
- data/lib/decidim/dev/assets/test_percent_encoded_fragment.svg +7 -0
- data/lib/decidim/dev/assets/test_percent_encoded_multibyte_reference.svg +7 -0
- data/lib/decidim/dev/assets/test_percent_encoded_multibyte_reference_mixed.svg +8 -0
- data/lib/decidim/dev/assets/test_presentation_attribute_references.svg +13 -0
- data/lib/decidim/dev/assets/test_references.svg +12 -0
- data/lib/decidim/dev/assets/test_style_text.svg +9 -0
- data/lib/decidim/dev/assets/video.mp4 +0 -0
- data/lib/decidim/dev/rubocop/cop/decidim/enforce_permission_to.rb +459 -0
- data/lib/decidim/dev/rubocop/cop/decidim/organization_scoped_finder.rb +200 -0
- data/lib/decidim/dev/test/rspec_support/capybara.rb +54 -0
- data/lib/decidim/dev/test/rspec_support/helpers.rb +14 -1
- data/lib/decidim/dev/version.rb +1 -1
- data/rubocop-decidim.yml +1 -0
- metadata +81 -14
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 233e63689f47b301ee8c1705b54514b214492cf773c809dbea59b3c3123007c3
|
|
4
|
+
data.tar.gz: 62593ef44761497308726e12365b1860a5684e00421748d26ab04f4101df5e3a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 29f076657738d241823247cc8cf53f161b1dc9eb363017525bc1f8ab67cc622cc546448b2d81ca624b782f16a179fba56ae98a87fe8c983cc438c729bbce6983
|
|
7
|
+
data.tar.gz: 261ae6b7bbd101c3b23784fad0988a0c8ce389036cd90220680d167194bf5fb7310d8c689ecfb8a6a3391d4bb1e6bf91e610a332116a3ce23c16642d6dc0da3b
|
data/config/locales/eu.yml
CHANGED
|
@@ -9,10 +9,10 @@ eu:
|
|
|
9
9
|
created_at: Sortua
|
|
10
10
|
decidim_scope_id: Eremua
|
|
11
11
|
field: Nire datu-eremua
|
|
12
|
-
start_date: Hasiera
|
|
12
|
+
start_date: Hasiera-data
|
|
13
13
|
title: Izenburua
|
|
14
14
|
translatable_text: Itzul daitekeen testua
|
|
15
|
-
updated_at:
|
|
15
|
+
updated_at: Eguneratze-data
|
|
16
16
|
decidim:
|
|
17
17
|
components:
|
|
18
18
|
dummy:
|
|
@@ -35,10 +35,10 @@ eu:
|
|
|
35
35
|
test_options:
|
|
36
36
|
bar: Bar
|
|
37
37
|
baz: Baz
|
|
38
|
-
foo:
|
|
38
|
+
foo: Foo
|
|
39
39
|
step:
|
|
40
|
-
likes_blocked:
|
|
41
|
-
likes_enabled:
|
|
40
|
+
likes_blocked: Atsegin dut blokeatuta
|
|
41
|
+
likes_enabled: Atsegin dut gaituta
|
|
42
42
|
readonly_step_attribute: Soilik irakurtzeko atributua
|
|
43
43
|
test_options:
|
|
44
44
|
bar: Bar
|
|
@@ -52,7 +52,7 @@ eu:
|
|
|
52
52
|
badges:
|
|
53
53
|
test:
|
|
54
54
|
conditions:
|
|
55
|
-
- Erabili
|
|
55
|
+
- Erabili proba-ingurune bat Decidim-erako.
|
|
56
56
|
description: Parte-hartzaileek garaikur hau lortzen dute probak sortzeagatik.
|
|
57
57
|
description_another: Parte-hartzaile honek %{score} proba egin ditu.
|
|
58
58
|
description_own: '%{score} proba sortu dituzu.'
|
data/config/locales/gl.yml
CHANGED
|
@@ -2,6 +2,9 @@
|
|
|
2
2
|
gl:
|
|
3
3
|
activemodel:
|
|
4
4
|
attributes:
|
|
5
|
+
dummy:
|
|
6
|
+
image: Imaxe
|
|
7
|
+
dummy_attribute: Atributo de proba
|
|
5
8
|
dummy_resource:
|
|
6
9
|
created_at: Creado en
|
|
7
10
|
decidim_scope_id: Ámbito
|
|
@@ -15,8 +18,16 @@ gl:
|
|
|
15
18
|
dummy:
|
|
16
19
|
settings:
|
|
17
20
|
global:
|
|
21
|
+
clear_all: Limpar todo
|
|
22
|
+
guided: Campo guiado
|
|
23
|
+
guided_help: Texto de axuda
|
|
24
|
+
guided_readonly: Campo desactivado
|
|
25
|
+
guided_rich: Campo enriquecido guiado
|
|
26
|
+
guided_rich_help_html: Texto HTML de <strong>axuda</strong>
|
|
27
|
+
guided_rich_readonly_html: Texto HTML de <strong>axuda</strong> para o campo desactivado
|
|
18
28
|
readonly_attribute: Atributo de só lectura
|
|
19
29
|
test: Unha proba
|
|
30
|
+
test_add: Engadir proba
|
|
20
31
|
test_choices:
|
|
21
32
|
a: Opción A
|
|
22
33
|
b: Opción B
|
|
@@ -26,6 +37,8 @@ gl:
|
|
|
26
37
|
baz: Baz
|
|
27
38
|
foo: Foo
|
|
28
39
|
step:
|
|
40
|
+
likes_blocked: Gústame bloqueados
|
|
41
|
+
likes_enabled: Gústame activados
|
|
29
42
|
readonly_step_attribute: Atributo de paso de só lectura
|
|
30
43
|
test_options:
|
|
31
44
|
bar: Bar
|
|
@@ -40,11 +53,12 @@ gl:
|
|
|
40
53
|
test:
|
|
41
54
|
conditions:
|
|
42
55
|
- Use un entorno de proba para decidir.
|
|
43
|
-
description: Os
|
|
56
|
+
description: Os participantes obtén esta insignia creando probas.
|
|
44
57
|
description_another: Este usuario creou %{score} probas.
|
|
45
58
|
description_own: Creaches %{score} probas.
|
|
46
59
|
name: Probas
|
|
47
60
|
next_level_in: Crea %{score} probas máis para chegar ao seguinte nivel!
|
|
61
|
+
unearned_another: Esta persoa participante aínda non creou ningunha proba.
|
|
48
62
|
unearned_own: Non creaches probas aínda.
|
|
49
63
|
resource_links:
|
|
50
64
|
test_link:
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
require:
|
|
2
|
+
- decidim/dev/rubocop/cop/decidim/organization_scoped_finder
|
|
3
|
+
- decidim/dev/rubocop/cop/decidim/enforce_permission_to
|
|
4
|
+
|
|
5
|
+
Decidim/OrganizationScopedFinder:
|
|
6
|
+
Enabled: true
|
|
7
|
+
Severity: warning
|
|
8
|
+
Include:
|
|
9
|
+
- "**/app/controllers/**/admin/**/*.rb"
|
|
10
|
+
Exclude:
|
|
11
|
+
- "**/decidim-system/**/*.rb"
|
|
12
|
+
|
|
13
|
+
Decidim/EnforcePermissionTo:
|
|
14
|
+
Enabled: true
|
|
15
|
+
Severity: warning
|
|
16
|
+
Include:
|
|
17
|
+
- "**/app/controllers/**/*.rb"
|
|
18
|
+
# This cop only understands action-level authorization checks
|
|
19
|
+
# (`enforce_permission_to` / `action_authorized_to`). The paths below are
|
|
20
|
+
# intentionally authorized through a different model, so they cannot be
|
|
21
|
+
# covered by an action-level check:
|
|
22
|
+
Exclude:
|
|
23
|
+
# - decidim-api: GraphQL/API entry points authorized by
|
|
24
|
+
# `ensure_api_authenticated!` and type-level authorization.
|
|
25
|
+
- "decidim-api/**/*.rb"
|
|
26
|
+
# - decidim-design: development-only styleguide app.
|
|
27
|
+
- "decidim-design/**/*.rb"
|
|
28
|
+
# - decidim-system: installation-wide system admin guarded by `authenticate_admin!`.
|
|
29
|
+
- "decidim-system/**/*.rb"
|
|
30
|
+
# - decidim-devise/doorkeeper: framework controllers where authentication
|
|
31
|
+
# itself is the operation (Devise, OAuth).
|
|
32
|
+
- "decidim-core/app/controllers/decidim/devise/**/*.rb"
|
|
33
|
+
- "decidim-core/app/controllers/decidim/doorkeeper/**/*.rb"
|
|
34
|
+
# - favicon: always visible
|
|
35
|
+
- decidim-core/app/controllers/decidim/favicon_controller.rb
|
|
36
|
+
# - errors: always visible
|
|
37
|
+
- decidim-core/app/controllers/decidim/errors_controller.rb
|
|
38
|
+
# - form_factory: builds form objects through an internal class; its methods
|
|
39
|
+
# are not controller actions.
|
|
40
|
+
- decidim-core/app/controllers/concerns/decidim/form_factory.rb
|
|
File without changes
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document with an unclosed element, which is not a well formed XML
|
|
3
|
+
document, so it is rejected instead of recovered. -->
|
|
4
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
5
|
+
<g>
|
|
6
|
+
<circle cx="8" cy="8" r="8"/>
|
|
7
|
+
</svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><set attributeName="onload" to="alert('xss')"/><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16"><animate attributeNames="href" values="#none;https://tracker.example.org/track.gif" dur="1s" fill="freeze"/></image></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><set attributeName="fill" to="url(https://tracker.example.org/paint.svg#gradient)"/><rect width="16" height="16"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g><set attributeName="style" to="background-image:url(https://tracker.example.org/track.gif)"/></g></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16"><a><animate attributeName="href" values="https://example.org;javascript:alert('xss')" dur="1s" repeatCount="indefinite"/><circle cx="8" cy="8" r="8" fill="#000"/></a></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g><set attributename="onload" to="alert('xss')"/></g><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="/\tracker.example.org/track.gif"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>circle { fill: #000; background: url(\5C\2F\2Ftracker.example.org/track.gif); }</style><circle cx="8" cy="8" r="8"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>circle { fill: #000; background: url(/*tracking*/"https://tracker.example.org/track.gif"); }</style><circle cx="8" cy="8" r="8"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>circle { fill: #000; background: image-set("logo.png" 1x, "https://tracker.example.org/track.gif" 2x); }</style><circle cx="8" cy="8" r="8"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>circle { fill: #000; background: image-set( ( ) , "https://tracker.example.org/track.gif" ); }</style><circle cx="8" cy="8" r="8"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><cursor href="https://tracker.example.org/cursor.svg" x="8" y="8"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g cursor="url(https://tracker.example.org/cursor.png)"><rect width="16" height="16"/></g></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="data:image/svg+xml,%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22ISO-8859-1%22%3F%3E%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3Ctext%3E%E9%3C%2Ftext%3E%3C%2Fsvg%3E"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxpbWFnZSBocmVmPSJkYXRhOmltYWdlL3N2Zyt4bWw7YmFzZTY0LFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanhwYldGblpTQm9jbVZtUFNKa1lYUmhPbWx0WVdkbEwzTjJaeXQ0Yld3N1ltRnpaVFkwTEZCSVRqSmFlVUkwWWxkNGRXTjZNR2xoU0ZJd1kwUnZka3d6WkROa2VUVXpUWGsxZG1OdFkzWk5ha0YzVFVNNWVtUnRZMmxRYW5od1lsZEdibHBUUW05amJWWnRVRk5LYTFsWVVtaFBiV3gwV1Zka2JFd3pUakphZVhRMFlsZDNOMWx0Um5wYVZGa3dURVpDU1ZScVNtRmxWVWt3V1d4a05HUlhUalpOUjJ4b1UwWkpkMWt3VW5aa2EzZDZXa1JPYTJWVVZYcFVXR3N4WkcxT2RGa3pXazVoYTBZelZGVk5OV1Z0VW5SWk1teFJZVzVvZDFsc1pFZGliSEJVVVcwNWFtSldXblJWUms1TFlURnNXVlZ0YUZCaVYzZ3dWMVprYTJKRmQzcFVha3BoWlZoUk1GbHNaRE5PTVd4MFVtNXdZVlpHYTNkVVJWcERVMVpTY1ZOdFJteFdWV3QzVjFkNGEwNUhVbGhVYWxwT1VqSjRiMVV3V2twa01XdDNWVzVhYTJFelpEWlhhMUpQWVRKV1ZWWlljRlZYUjNONFdrY3hUMlJHYTNwWGF6Vm9ZVEJaZWxaR1ZrNU9WMVowVlc1U1drMXRlRkpaVnpWdlpERnNjMXBGWkdsaVNFSlZWVmN3TldGdFNsZFhibEpXVW1zMVRGbFVSbk5YVmxaMFlVWkNhVll6WjNkV01WcHJZVEpLUm1RemNGVmhhM0JvV2xab1VrMUdiSE5hUkU1UFRWZDRNRlZ0TlhkWlZscEhZVE5rVlZKV2NFUlZNVnBUWTFaT2RGSnRlRmRXVjNRelZqRmtOR0V3TlVoVmJHaFZZV3h3VDFWcVNqUmlNVlYzVjJ0d2EwMVhkRE5XVnpWaFlUSkZlbHBFV2xoaE1VcFFXVlJLVjFaV1dsbGpSbFpZVWpOT05GZHJZM2hVTWxKSFlUTndXR0Y2Vm05WlZFSmFaV3hhUjFack5VOVdNVm93VmxjMVUxZHJNWFJsUmtwYVZucFdkbHBFUm5Oak1YQkdXa2RzYVZORlNsWldWbU4zVGxkR2RGTnNaRmhpYkVwWFZXMXpNVlJHYkZWU2JrNVlWbXhhTUZsVldrTmhWbGw2V2pOa1YwMVdjSEpaVkVwTFVtMVJlbU5HVm1oaE0wSnZWMnhhYjFWck1VZGlTRTVoVWtVMVVGUldaRFJOUmxaMFRsaGtXbFpzY0VoWlZFNXJWbFpLVjJORlVsWk5WbkJVV1RGYVQyUkdTblJsUm1SWFZqTlJlbFpxUm10T1IwVjNUbFZvVm1KSGFGWlpWM2gzVkRGV2NWTnFVbWxOVmxZelZqSjBkMkV3TVZoa1JFNVhWbnBXYUZsVVNrWmxiSEJGVjJ4b2FFMVZjRkZYVmxKTFZqRmFWMWRzYkdwU2JGcFpWV3BPVDA1R1pISlpNMmhWVFd4S1NGbFVUbmRYUjBZMlZtMDVXbFpGU21GYVYzaGhVakZhY2s1Vk9WZE5WbTkzVm14ak1WVXhaSEpOV0ZKc1VtdHdZVlp1Y0Zka2JIQkZVbTVPYWsxWVFrZFhhMlJ6WVZaT1JsTnNXbGRXYlU0elZHeGtSMlJHVG5OYVJtaHBZa1Z3V0ZaWE1YcE5WazE0VlZoa1lWSlVWbk5aYTJSVFRVWlNjMVp1WkZkU2EydzFWMnBPYTFkR1dYcFZia1pWVm0xU1dGbDZSa2RqTVZaelZXMXNWMUl6YURWV2JGSkRXVlpOZDAxSWFGWlhSM2h2V2xkNFMyTnNiSE5YYTJSUFlrZFNlVlpYY3pWV1ZsbDNZMFJDVjFJelFtaFdiRnBMVG14R1ZWSnRSbGRpU0VGNlZrZDRWazVXVGxoVGExcFBWbXMxVkZac1duTk9iRnB5Vm14T1ZVMVdSak5VVm1oUFlXeEtSMWRzVmxkV1JUVlVWbGQ0Vm1ReFdsVlNiWEJYWWxoUk1WWkdXbTlVTWtWM1RWaE9WR0V4Y0ZaWmEyUlRaR3hzVjFkcmNHeFNiVko0Vm0weFIxVXhXbFZXYWtaWVlrWmFXRlJWV21GWFJsWlpZMFpvYVZkRlNsQlhWbWgzVm1zeFYxcEdaRmhpVkd4VFZGVlNSMU5HVmxoT1ZXUm9UVVJDTkZrd2FFZFdWbHBHVjJwT1lWSnNjRmhWTUdSTFVtMU9TR1JIYkZOV1dFRXdWakowVTFReGJGaFNia3BPVTBkb2NWVXdXbUZXTVZaeFUyczFUMVpzV2toV1IzUjNZVEpLUmxOdWFHRlNSVFZvV1ZkemQyVkhUa2xXYkZwVFRXc3dNVlpWV2s5VGJWSnpVVzVHYTAweGNIRlVWRVozWkZaV1NGbDZiRkZWTUd3eVZVZHdNMlJ0VFhwWGJUVlJXbm93T1VscE9DdFFRemw2Wkcxakt5SXZQand2YzNablBnPT0iLz48L3N2Zz4="/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href=" data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4="/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4="/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="data:image/svg+xml;charset=utf-8;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4="/></svg>
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document which declares a parameter entity in the internal subset of its
|
|
3
|
+
document type definition, which is a declaration even when it is not used. -->
|
|
4
|
+
<!DOCTYPE svg [
|
|
5
|
+
<!ENTITY % parameter "value">
|
|
6
|
+
]>
|
|
7
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><text y="8">Example</text></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16"><animate attributeName="href" values="#none;https://tracker.example.org/track.gif" dur="1s" fill="freeze"/></image></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><a><animate href="#missing" attributeName="href" to="https://tracker.example.org/track.gif" fill="freeze"/></a></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16"><image id="pic" width="16" height="16"/><g><animate xlink:href="#pic" attributeName="href" values="#none;https://tracker.example.org/track.gif" dur="1s" fill="freeze"/></g></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><defs><filter id="f"><feImage href="https://evil.example.org/map.png" result="i"/></filter></defs><rect width="16" height="16" filter="url(#f)"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image href="https://tracker.example.org/track.gif" width="16" height="16"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16"><use xlink:href="https://evil.example.org/sprite.svg#icon"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><rect width="16" height="16" fill="url(https://example.org/paint.svg#gradient)"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><foreignObject width="16" height="16"><div xmlns="http://www.w3.org/1999/xhtml">Hello</div></foreignObject><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" onload="alert('xss')"><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="M 1 8 h 14" fill="none" stroke="#000" marker-end="url(https://example.org/markers.svg#arrow)"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><defs><mask id="mask"><rect width="16" height="16" fill="#fff"/></mask></defs><rect width="16" height="16" mask="url(https://tracker.example.org/mask.png)"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><script>alert("xss")</script><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.a::after { content: "/*"; } .b { background: url(https://example.org/background.png); } .c::after { content: "*/"; }</style><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>@import url(https://example.org/style.css);</style><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>@import "https://example.org/style.css";</style><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.logo { background: u\72l("https://example.org/background.png"); } .logo2 { background: \75rl("https://example.org/other.png"); }</style><circle class="logo" cx="8" cy="8" r="8" fill="#000"/><circle class="logo2" cx="8" cy="8" r="4" fill="#fff"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.logo { background: url("https://example.org/background.png"); }</style><circle class="logo" cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet type="text/css" href="https://example.org/style.css"?><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16"><a xlink:href="javascript:alert('xss')"><circle cx="8" cy="8" r="8" fill="#000"/></a></svg>
|
|
Binary file
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������ޭ������
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><circle cx="8" cy="8" r="8" fill="#000"/></svg>
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><circle cx="8" cy="8" r="8" fill="#000"><animate attributeName="cx" values="4;8;12" dur="1s" repeatCount="indefinite"/></circle></svg>
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- Animations assigning external links to "a" elements, which do not load any resource when the document is rendered, both modifying their parent element and referencing the target element with their own "href". -->
|
|
3
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
4
|
+
<a><set attributeName="href" to="https://example.org"/><text y="8">Example</text></a>
|
|
5
|
+
<a id="link"><text y="15">Other</text></a>
|
|
6
|
+
<g><animate href="#link" attributeName="href" values="#none;https://other.example.org" dur="1s" fill="freeze"/></g>
|
|
7
|
+
</svg>
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- An animation assigning a presentation attribute whose reference resolves to an
|
|
3
|
+
element of the document itself, which is fetched only when the animation reaches
|
|
4
|
+
it, so the document is accepted. -->
|
|
5
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
6
|
+
<defs><pattern id="paint"><rect width="16" height="16"/></pattern></defs>
|
|
7
|
+
<rect width="16" height="16"><animate attributeName="fill" values="url(#paint);url(#paint)" dur="1s"/></rect>
|
|
8
|
+
</svg>
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
3
|
+
<!-- A logo exported by a vector editor, using a style sheet, symbol reuse and an embedded raster image. -->
|
|
4
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
5
|
+
<style>.logo { fill: #000; } .dot { fill: url(#dot); }</style>
|
|
6
|
+
<defs>
|
|
7
|
+
<circle id="dot" cx="8" cy="8" r="8"/>
|
|
8
|
+
</defs>
|
|
9
|
+
<use xlink:href="#dot" class="logo" style="fill:url(#dot);"/>
|
|
10
|
+
<image href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==" width="1" height="1"/>
|
|
11
|
+
<a xlink:href="https://example.org"><text y="15">offset=0; one=1</text></a>
|
|
12
|
+
</svg>
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document whose CSS references are resolved against the document itself:
|
|
3
|
+
the paint server and the mask, which are not fetched as the properties
|
|
4
|
+
accepting them only refer to elements of the document, and the text which
|
|
5
|
+
only looks like a reference because it is inside a string which is not an
|
|
6
|
+
argument of a function loading a resource. -->
|
|
7
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
8
|
+
<defs>
|
|
9
|
+
<pattern id="paint"><rect width="16" height="16"/></pattern>
|
|
10
|
+
<mask id="mask"><rect width="16" height="16" fill="#fff"/></mask>
|
|
11
|
+
</defs>
|
|
12
|
+
<style>.logo { fill: url(#paint); mask: url(#mask); content: "image-set(\"https://example.org/logo.png\")"; }</style>
|
|
13
|
+
<circle class="logo" cx="8" cy="8" r="8" mask="url(#mask)"/>
|
|
14
|
+
</svg>
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- An inline data reference which declares its own encoding. Its contents are
|
|
3
|
+
decoded as bytes, so the declared encoding is still read when they are
|
|
4
|
+
parsed as a nested document. -->
|
|
5
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><image width="16" height="16" href="data:image/svg+xml,%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22ISO-8859-1%22%3F%3E%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Ctext%3E%E9%3C%2Ftext%3E%3C%2Fsvg%3E"/></svg>
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document which mentions an entity declaration only inside a comment and
|
|
3
|
+
inside a CDATA section, where they are not interpreted as declarations. -->
|
|
4
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
5
|
+
<!-- Exported by a tool which documented that <!ENTITY declarations are not used. -->
|
|
6
|
+
<style><![CDATA[/* The text "<!ENTITY foo>" here is not a declaration. */ circle { fill: #000; }]]></style>
|
|
7
|
+
<circle cx="8" cy="8" r="8"/>
|
|
8
|
+
</svg>
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document which mentions an entity declaration inside a processing
|
|
3
|
+
instruction, where it is only text and not a declaration. -->
|
|
4
|
+
<?editor <!ENTITY documented "text of the instruction" ?>
|
|
5
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
6
|
+
<text y="15">Example</text>
|
|
7
|
+
</svg>
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- An animation whose target reference is percent encoded, which browsers
|
|
3
|
+
resolve to the identifier of a link, which does not load any resource. -->
|
|
4
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
5
|
+
<a id="link" xlink:href="https://example.org"><text y="15">Example</text></a>
|
|
6
|
+
<set xlink:href="#%6C%69%6E%6B" attributeName="href" to="https://example.org" dur="1s" fill="freeze"/>
|
|
7
|
+
</svg>
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- An animation whose target reference decodes to the multi-byte identifier of
|
|
3
|
+
a link, which does not load any resource. -->
|
|
4
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
5
|
+
<a id="café" xlink:href="https://example.org"><text y="15">Example</text></a>
|
|
6
|
+
<set xlink:href="#caf%C3%A9" attributeName="href" to="https://example.org" dur="1s" fill="freeze"/>
|
|
7
|
+
</svg>
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- An animation whose target reference mixes a literal multi-byte character
|
|
3
|
+
with percent encoded bytes, which browsers resolve to the identifier of a
|
|
4
|
+
link, which does not load any resource. -->
|
|
5
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
6
|
+
<a id="caféé" xlink:href="https://example.org"><text y="15">Example</text></a>
|
|
7
|
+
<set xlink:href="#café%C3%A9" attributeName="href" to="https://example.org" dur="1s" fill="freeze"/>
|
|
8
|
+
</svg>
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A document whose presentation attributes reference elements of the document
|
|
3
|
+
itself: the paint server, the filter, the clipping path and the marker,
|
|
4
|
+
which are resolved without fetching any resource. -->
|
|
5
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
6
|
+
<defs>
|
|
7
|
+
<pattern id="paint"><rect width="16" height="16"/></pattern>
|
|
8
|
+
<filter id="blur"><feGaussianBlur stdDeviation="1"/></filter>
|
|
9
|
+
<clipPath id="clip"><circle cx="8" cy="8" r="8"/></clipPath>
|
|
10
|
+
<marker id="arrow" markerWidth="4" markerHeight="4" refX="2" refY="2"><path d="M 0 0 l 4 2 l -4 2 z"/></marker>
|
|
11
|
+
</defs>
|
|
12
|
+
<rect width="16" height="16" fill="url(#paint)" stroke="#000" filter="url(#blur)" clip-path="url(#clip)" marker-end="url(#arrow)"/>
|
|
13
|
+
</svg>
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A logo referencing resources which are resolved against the document itself (fragments and relative paths) or which are inline (data URIs), and linking to an external site, which does not load any resource. -->
|
|
3
|
+
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 16 16">
|
|
4
|
+
<defs>
|
|
5
|
+
<circle id="dot" cx="8" cy="8" r="8"/>
|
|
6
|
+
</defs>
|
|
7
|
+
<use href="#dot"/>
|
|
8
|
+
<image href="logo.png" width="16" height="16"/>
|
|
9
|
+
<image xlink:href="/assets/logo.png" width="16" height="16"/>
|
|
10
|
+
<image href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==" width="1" height="1"/>
|
|
11
|
+
<a xlink:href="https://example.org"><text y="15">Example</text></a>
|
|
12
|
+
</svg>
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!-- A logo whose style sheet mentions resource references only inside quoted text and comments, which are rendered as content and never loaded. -->
|
|
3
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
|
|
4
|
+
<style>.logo::after { content: "See @import instructions"; } .logo::before { content: "url(https://example.org/logo.png)"; } .logo::first-line { content: "u\72l(https://example.org/logo.png)"; } .logo { fill: url(#dot); /* background: url(https://example.org) */ }</style>
|
|
5
|
+
<defs>
|
|
6
|
+
<circle id="dot" cx="8" cy="8" r="8"/>
|
|
7
|
+
</defs>
|
|
8
|
+
<circle class="logo" cx="8" cy="8" r="8" fill="#000" style="content: 'url(https://example.org) and @import'"/>
|
|
9
|
+
</svg>
|
|
Binary file
|