kiso-icons 0.1.0.pre → 0.2.0.pre

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f91c4c7b067ad325b199468604b89aead98ba16f3c99469aff5e2ef836d4878
-  data.tar.gz: d9f4b770b5081f8bbd463591710dadb8b9e198b4526bb226d60563f065b92c1e
+  metadata.gz: abdce35f898bcd015e68eb0fd14ec634c00f48b7c439e1937cb57ce36da1b89b
+  data.tar.gz: e848efc526a44648dd41a34adf83ffe7f73666eb2bb38cefd48d188670a517c1
 SHA512:
-  metadata.gz: 2db2872c247bc11a982224eff8feb89ddc63b2ba51b96aba1783e5c9fab9dadf73b336554fb0caa13b26014028e64d0be5ad5db0656382c472650a179ba1fdd2
-  data.tar.gz: 9633012b948ac6fb942ef2b51408dc4c1cd64f82daf61d4c3cadb4d1957bd43d377afab5cdc9f376ba38f8a307bf39608ef3d97d13bb7c4dba7e9cd0642b4194
+  metadata.gz: 8ad7085b951095eb5540babda7bf8b0495b2111ee70bacbfdd7f0d63f6c4443427786b11d4e114657112bab9c99750fff4bd010c00e22b72d4bfc6996a5630b9
+  data.tar.gz: 0d528a7c8a0d73f3f7f3a6926a148bce8152738d8c54eaffa280cdf14bd10ef3fd743b8cfb741a1a271c79b846f97dbd74cdcd41118e4e93ac41cf1dd3469812

data/lib/kiso/icons/renderer.rb

@@ -1,11 +1,20 @@
 # frozen_string_literal: true
 
+require "loofah"
+
 module Kiso
   module Icons
     class Renderer
+      BLOCKED_SVG_ELEMENTS = %w[
+        script foreignobject iframe object embed
+      ].freeze
+
+      EVENT_HANDLER_RE = /\Aon/i
+      JAVASCRIPT_URI_RE = /\A\s*javascript:/i
+
       class << self
         def render(icon_data, css_class: nil, **options)
-          body = icon_data[:body]
+          body = sanitize_svg_body(icon_data[:body])
           width = icon_data[:width]
           height = icon_data[:height]
 
@@ -47,6 +56,12 @@ module Kiso
 
         private
 
+        def sanitize_svg_body(body)
+          return "" if body.nil? || body.empty?
+
+          Loofah.scrub_fragment(body, SVG_SCRUBBER).to_s
+        end
+
         def escape_attr(value)
           value.to_s
             .gsub("&", "&amp;")
@@ -55,6 +70,35 @@ module Kiso
             .gsub(">", "&gt;")
         end
       end
+
+      # Loofah scrubber that strips dangerous elements and event handlers
+      # from SVG body content while preserving legitimate SVG markup.
+      class SvgScrubber < Loofah::Scrubber
+        def initialize
+          @direction = :top_down
+        end
+
+        def scrub(node)
+          return CONTINUE if node.text? || node.cdata?
+
+          if BLOCKED_SVG_ELEMENTS.include?(node.name.downcase)
+            node.remove
+            return STOP
+          end
+
+          node.attribute_nodes.each do |attr|
+            if attr.name.match?(EVENT_HANDLER_RE)
+              attr.remove
+            elsif attr.name.casecmp("href").zero? || attr.name == "xlink:href"
+              attr.remove if attr.value.match?(JAVASCRIPT_URI_RE)
+            end
+          end
+
+          CONTINUE
+        end
+      end
+
+      SVG_SCRUBBER = SvgScrubber.new.freeze
     end
   end
 end

data/lib/kiso/icons/version.rb

@@ -2,6 +2,6 @@
 
 module Kiso
   module Icons
-    VERSION = "0.1.0.pre"
+    VERSION = "0.2.0.pre"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kiso-icons
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre
+  version: 0.2.0.pre
 platform: ruby
 authors:
 - Steve Clarke