Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve SVG cleanup after sanitization #481

Merged
merged 2 commits into from
Feb 5, 2016
Merged

Improve SVG cleanup after sanitization #481

merged 2 commits into from
Feb 5, 2016

Conversation

oparoz
Copy link
Contributor

@oparoz oparoz commented Dec 24, 2015

Fixes #467

I've loaded my standard samples as well as an "armed" SVG and there is only one SVG which can't be properly rendered. It seems impossible to get it to display properly without opening the gate as it contains internal references.

@oparoz oparoz self-assigned this Dec 24, 2015
@oparoz oparoz added this to the 9.0-current milestone Dec 24, 2015
@oparoz
Copy link
Contributor Author

oparoz commented Dec 25, 2015

@LukasReschke if you could test this to make sure it's still as safe as before. The people at DOMPurify seem to think so.

@oparoz
Copy link
Contributor Author

oparoz commented Jan 22, 2016

Ping @LukasReschke

@oparoz
Copy link
Contributor Author

oparoz commented Jan 22, 2016

In short:

  • The custom hooks have been moved to the utility class, to be shared between the slideshow and the gallery app
  • Illustrator doctype is replaced with standard one
  • Filter tags are allowed in SVGs
  • Garbage characters left at the start of a purified SVG are removed
  • DOM purify has been updated to 0.7.3

@LukasReschke
Copy link
Member

Great stuff! 👍

oparoz added a commit that referenced this pull request Feb 5, 2016
Improve SVG cleanup after sanitization
@oparoz oparoz merged commit 61f6728 into master Feb 5, 2016
@oparoz
Copy link
Contributor Author

oparoz commented Feb 5, 2016

Thanks for the review! :)

@DeepDiver1975 DeepDiver1975 changed the title Improve SVG cleanup after sanitization Improve SVG cleanup after sanitization Feb 5, 2016
@oparoz oparoz deleted the update-dompurify branch February 5, 2016 18:05
@oparoz oparoz removed the QA-testing label Mar 14, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants