Marc Mintel
5397309103
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 20s
Build & Deploy / 🧪 QA (push) Failing after 34s
Build & Deploy / 🏗️ Build (push) Has started running
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Smoke Test (push) Has been cancelled
Build & Deploy / ⚡ Lighthouse (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
1 line
2.8 KiB
Plaintext
1 line
2.8 KiB
Plaintext
{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["/**\n * Securely detect if an XML buffer contains a valid SVG document\n */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n try {\n // Limit buffer size to prevent processing large malicious files\n const maxSize = 2048\n const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize))\n\n // Check for XML declaration and extract encoding if present\n const xmlDeclMatch = content.match(/^<\\?xml[^>]*encoding=[\"']([^\"']+)[\"']/i)\n const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase()\n\n // Only support safe encodings\n if (declaredEncoding && !['ascii', 'utf-8', 'utf8'].includes(declaredEncoding)) {\n return false\n }\n\n // Remove XML declarations, comments, and processing instructions\n const cleanContent = content\n .replace(/<\\?xml[^>]*\\?>/gi, '')\n .replace(/<!--[\\s\\S]*?-->/g, '')\n .replace(/<\\?[^>]*\\?>/g, '')\n .trim()\n\n // Find the first actual element (root element)\n const rootElementMatch = cleanContent.match(/^<(\\w+)(?:\\s|>)/)\n if (!rootElementMatch || rootElementMatch[1] !== 'svg') {\n return false\n }\n\n // Validate SVG namespace - must be present for valid SVG\n const svgNamespaceRegex = /xmlns=[\"']http:\\/\\/www\\.w3\\.org\\/2000\\/svg[\"']/\n if (!svgNamespaceRegex.test(content)) {\n return false\n }\n\n // Additional validation: ensure it's not malformed\n const svgOpenTag = content.match(/<svg[\\s>]/)\n if (!svgOpenTag) {\n return false\n }\n\n return true\n } catch (_error) {\n // If any error occurs during parsing, treat as not SVG\n return false\n }\n}\n"],"names":["detectSvgFromXml","buffer","maxSize","content","toString","Math","min","length","xmlDeclMatch","match","declaredEncoding","toLowerCase","includes","cleanContent","replace","trim","rootElementMatch","svgNamespaceRegex","test","svgOpenTag","_error"],"mappings":"AAAA;;CAEC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,IAAI;QACF,gEAAgE;QAChE,MAAMC,UAAU;QAChB,MAAMC,UAAUF,OAAOG,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAACL,OAAOM,MAAM,EAAEL;QAEnE,4DAA4D;QAC5D,MAAMM,eAAeL,QAAQM,KAAK,CAAC;QACnC,MAAMC,mBAAmBF,cAAc,CAAC,EAAE,EAAEG;QAE5C,8BAA8B;QAC9B,IAAID,oBAAoB,CAAC;YAAC;YAAS;YAAS;SAAO,CAACE,QAAQ,CAACF,mBAAmB;YAC9E,OAAO;QACT;QAEA,iEAAiE;QACjE,MAAMG,eAAeV,QAClBW,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,gBAAgB,IACxBC,IAAI;QAEP,+CAA+C;QAC/C,MAAMC,mBAAmBH,aAAaJ,KAAK,CAAC;QAC5C,IAAI,CAACO,oBAAoBA,gBAAgB,CAAC,EAAE,KAAK,OAAO;YACtD,OAAO;QACT;QAEA,yDAAyD;QACzD,MAAMC,oBAAoB;QAC1B,IAAI,CAACA,kBAAkBC,IAAI,CAACf,UAAU;YACpC,OAAO;QACT;QAEA,mDAAmD;QACnD,MAAMgB,aAAahB,QAAQM,KAAK,CAAC;QACjC,IAAI,CAACU,YAAY;YACf,OAAO;QACT;QAEA,OAAO;IACT,EAAE,OAAOC,QAAQ;QACf,uDAAuD;QACvD,OAAO;IACT;AACF"} |