Marc Mintel
5397309103
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 20s
Build & Deploy / 🧪 QA (push) Failing after 34s
Build & Deploy / 🏗️ Build (push) Has started running
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Smoke Test (push) Has been cancelled
Build & Deploy / ⚡ Lighthouse (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
1 line
2.1 KiB
Plaintext
1 line
2.1 KiB
Plaintext
{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["/**\n * Validate SVG content for security vulnerabilities\n * Detects and blocks malicious patterns commonly used in SVG-based attacks\n */\nexport function validateSvg(buffer: Buffer): boolean {\n try {\n const content = buffer.toString('utf8')\n\n const dangerousPatterns = [\n // Script tags\n /<script[\\s>]/i,\n /<\\/script>/i,\n\n // Event handlers (onclick, onload, onerror, etc.)\n /\\son\\w+\\s*=/i,\n\n // JavaScript URLs\n /javascript:/i,\n /data:text\\/html/i,\n\n // Foreign objects (can embed HTML)\n /<foreignObject[\\s>]/i,\n\n // Embedded iframes\n /<iframe[\\s>]/i,\n\n // Embedded objects and embeds\n /<object[\\s>]/i,\n /<embed[\\s>]/i,\n\n // Base64 encoded scripts (common obfuscation technique)\n /data:image\\/svg\\+xml;base64,[\\w+/]*PHNjcmlwdA/i, // <script in base64\n\n // XLink href with javascript (deprecated but still dangerous)\n /xlink:href\\s*=\\s*[\"']javascript:/i,\n\n // Import statements\n /@import/i,\n\n // External resource references that could be dangerous\n /<!ENTITY/i,\n /<!DOCTYPE[^>]*\\[/i, // DOCTYPE with internal subset\n\n // Attempt to use CDATA to hide scripts\n /<!\\[CDATA\\[[\\s\\S]*<script/i,\n ]\n\n for (const pattern of dangerousPatterns) {\n if (pattern.test(content)) {\n return false\n }\n }\n\n return true\n } catch (_error) {\n return false\n }\n}\n"],"names":["validateSvg","buffer","content","toString","dangerousPatterns","pattern","test","_error"],"mappings":"AAAA;;;CAGC,GACD,OAAO,SAASA,YAAYC,MAAc;IACxC,IAAI;QACF,MAAMC,UAAUD,OAAOE,QAAQ,CAAC;QAEhC,MAAMC,oBAAoB;YACxB,cAAc;YACd;YACA;YAEA,kDAAkD;YAClD;YAEA,kBAAkB;YAClB;YACA;YAEA,mCAAmC;YACnC;YAEA,mBAAmB;YACnB;YAEA,8BAA8B;YAC9B;YACA;YAEA,wDAAwD;YACxD;YAEA,8DAA8D;YAC9D;YAEA,oBAAoB;YACpB;YAEA,uDAAuD;YACvD;YACA;YAEA,uCAAuC;YACvC;SACD;QAED,KAAK,MAAMC,WAAWD,kBAAmB;YACvC,IAAIC,QAAQC,IAAI,CAACJ,UAAU;gBACzB,OAAO;YACT;QACF;QAEA,OAAO;IACT,EAAE,OAAOK,QAAQ;QACf,OAAO;IACT;AACF"} |