Skip to content

fix: Allow any SVG #1335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
martinthomson wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix: Allow any SVG #1335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
94c37a1
fix: Allow any SVG
martinthomson Jul 6, 2026
abdcd2c
Fix the documentation generation
martinthomson Jul 6, 2026
3fcdd66
Strip scripts from SVG
martinthomson Jul 20, 2026
8c9cab9
Make the stripping more complete
martinthomson Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 30 additions & 2 deletions test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
from xml2rfc.writers.base import default_options, BaseV3Writer, RfcWriterError
from xml2rfc.writers import DatatrackerToBibConverter
from xml2rfc.writers.text import MAX_WIDTH
from xml2rfc.utils import strip_link_attachments
from xml2rfc.utils import strip_link_attachments, strip_svg_scripts
from xml2rfc.util.file import can_access, FileAccessError

try:
Expand Down Expand Up @@ -567,6 +567,7 @@ def test_get_font_family(self):
def test_set_font_family(self):
input_svg = lxml.etree.fromstring('''
<svg xmlns="http://www.w3.org/2000/svg">
<style>:root { font: "monospace"; }</style>
<path />
<g>
<text>foobar</text>
Expand All @@ -578,6 +579,7 @@ def test_set_font_family(self):
</svg>''')
expected_svg = lxml.etree.tostring(lxml.etree.fromstring('''
<svg xmlns="http://www.w3.org/2000/svg">
<style>:root { font: "monospace"; }</style>
<path />
<g>
<text>foobar</text>
Expand Down Expand Up @@ -1163,7 +1165,7 @@ def test_allowed_access_template(self):
access_templates=True))


class StripLinkAttachmentsTest(unittest.TestCase):
class SanitizeTest(unittest.TestCase):
def setUp(self):
self.options = copy.deepcopy(default_options)

Expand Down Expand Up @@ -1194,6 +1196,32 @@ def test_strips_attachement(self):
self.assertNotIn("/etc/passwd", xml_str)
self.assertNotIn("/home/vader/ds-1/schematics", xml_str)

def test_strip_svg(self):
self.options.allow_local_file_access = False
svg_with_scripts = lxml.etree.fromstring('''
<rfc><svg xmlns="http://www.w3.org/2000/svg">
<script>globalThis.alert("haha");</script>
<foreignObject xmlns="otherns"></foreignObject>
<style>ok { foo: url(#local); }</style>
<style>notok { foo: url(not-local); }</style>
<use href="#a"></use>
<use href="https://..."></use>
<text onclick="globalThis.alert(1)">foobar</text>
</svg></rfc>''')
expected_svg = lxml.etree.fromstring('''
<rfc><svg xmlns="http://www.w3.org/2000/svg">
<style>ok { foo: url(#local); }</style>
<use href="#a"></use>
<use/>
<text>foobar</text>
</svg></rfc>''')

strip_svg_scripts(svg_with_scripts)

sanitized = lxml.etree.tostring(svg_with_scripts)
expected = lxml.etree.tostring(expected_svg)
self.assertEqual(sanitized, expected)


if __name__ == '__main__':
unittest.main()
Loading
Loading