Skip to content

fix: svgs are now being saved #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
battlemag5 wants to merge 2 commits into
base: main
Choose a base branch
from
+28 −0
Open

fix: svgs are now being saved #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
71cfc64
Allow SVG data URLs in drawing files
battlemag3 Mar 3, 2026
313c85a
Merge branch 'ZimengXiong:main' into fix/allow-svg-dataurl
battlemag5 Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions backend/src/__tests__/drawings.integration.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,33 @@ describe("Security Sanitization - Image Data URLs", () => {
expect(resultDataUrl.length).toBe(originalDataUrl.length);
});

it("should preserve svg image data URLs", () => {
const svgDataUrl =
"data:image/svg+xml;utf8," +
encodeURIComponent(
"<svg xmlns='http://www.w3.org/2000/svg' width='120' height='80'><rect width='120' height='80' fill='#4f46e5'/></svg>"
);
const files = {
"file-1": {
id: "file-1",
mimeType: "image/svg+xml",
dataURL: svgDataUrl,
created: Date.now(),
},
};

const result = sanitizeDrawingData({
elements: [],
appState: { viewBackgroundColor: "#ffffff" },
files,
});

const resultFiles = result.files as Record<string, any>;
const resultDataUrl = resultFiles["file-1"].dataURL;

expect(resultDataUrl).toBe(svgDataUrl);
});

it("should preserve large image data URLs (>10000 chars) - REGRESSION TEST for issue #17", () => {
const files = createSampleFilesObject(1, "large");
const originalDataUrl = Object.values(files)[0].dataURL;
Expand Down
1 change: 1 addition & 0 deletions backend/src/security.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,6 +475,7 @@ export const sanitizeDrawingData = (data: {
"data:image/jpg",
"data:image/gif",
"data:image/webp",
"data:image/svg+xml",
Copy link
Copy Markdown
Owner

@ZimengXiong ZimengXiong Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Allowing data:image/svg+xml through the sanitizer unconditionally is too broad; SVG payloads need tighter validation than the other image formats here.

A safer approach would be to only preserve SVG data URLs after decoding and validating the SVG content itself, for example by rejecting active content (<script>, event handlers, external references, unsafe foreignObject, etc.) and only allowing a constrained subset back into data:image/svg+xml.

];

const dangerousProtocols = [
Expand Down