Summary
Renderer utilities manually build JSON/SVG strings and only partially escape user-controlled values. Characters such as &, ', quotes, and control characters can produce malformed metadata or SVG output.
Affected Code
packages/utilities/src/renderer/svg.cairo:99packages/utilities/src/renderer/svg.cairo:252packages/utilities/src/renderer/svg.cairo:474packages/utilities/src/utils/json.cairo:77
Risk
Malformed token metadata or SVG rendering issues in wallets, marketplaces, and indexers.
Suggested Fix
Introduce dedicated JSON string escaping and SVG/XML text/attribute escaping helpers, then use them consistently.
Suggested Tests
Add cases with the following characters in names, image URLs, context values, and JSON arrays:
&'"<>%- commas
- backslashes
- control characters
Summary
Renderer utilities manually build JSON/SVG strings and only partially escape user-controlled values. Characters such as
&,', quotes, and control characters can produce malformed metadata or SVG output.Affected Code
packages/utilities/src/renderer/svg.cairo:99packages/utilities/src/renderer/svg.cairo:252packages/utilities/src/renderer/svg.cairo:474packages/utilities/src/utils/json.cairo:77Risk
Malformed token metadata or SVG rendering issues in wallets, marketplaces, and indexers.
Suggested Fix
Introduce dedicated JSON string escaping and SVG/XML text/attribute escaping helpers, then use them consistently.
Suggested Tests
Add cases with the following characters in names, image URLs, context values, and JSON arrays:
&'"<>%