Sanitize and minify SVG on upload to avoid XSS vulnerability

# Conflicts: # include/inc_lib/revision/revision.php
slackero · Aug 19, 2021 · b39db9c · b39db9c
1 parent 4db6ac2
commit b39db9c
Show file tree

Hide file tree

Showing 69 changed files with 125,017 additions and 2 deletions.
diff --git a/composer.json b/composer.json
@@ -0,0 +1,8 @@
+{
+    "config": {
+        "vendor-dir": "include/vendor"
+    },
+    "require": {
+        "enshrined/svg-sanitize": "^0.14.1"
+    }
+}
diff --git a/composer.lock b/composer.lock
diff --git a/include/inc_act/act_upload.php b/include/inc_act/act_upload.php
@@ -106,6 +106,8 @@
             $data['f_image_height'] = $file_svg['height'];
         }
 
+
+
     }
 
 	$insert = _dbInsert('phpwcms_file', $data);

diff --git a/include/inc_lib/classes/class.svg-reader.php b/include/inc_lib/classes/class.svg-reader.php
@@ -25,11 +25,23 @@
  * @license GPL-2.0-or-later
  */
 
+use enshrined\svgSanitize\Sanitizer;
+
 /**
  * SVGMetadataExtractor class.
  */
 class SVGMetadataExtractor {
-    static function getMetadata( $filename ) {
+    static function getMetadata( $filename, $sanitize=true ) {
+        if ($sanitize && is_file( $filename )) {
+            $sanitizer = new Sanitizer();
+            $sanitizer->minify(true);
+            $sanitizer->removeXMLTag(true);
+            $dirtySVG = file_get_contents( $filename );
+            if ($dirtySVG && ($cleanSVG = $sanitizer->sanitize( $dirtySVG ))) {
+                file_put_contents( $filename, trim($cleanSVG) );
+            }
+        }
+
         $svg = new SVGReader( $filename );
         return $svg->getMetadata();
     }

diff --git a/include/inc_lib/default.inc.php b/include/inc_lib/default.inc.php
@@ -150,6 +150,7 @@
 // Mime-Type definitions
 require_once PHPWCMS_ROOT . '/include/inc_lib/mimetype.inc.php';
 require_once PHPWCMS_ROOT . '/include/inc_lib/revision/revision.php';
+require_once PHPWCMS_ROOT . '/include/vendor/autoload.php';
 
 phpwcms_getUserAgent();
 define('BROWSER_NAME', $phpwcms['USER_AGENT']['agent']);

diff --git a/include/inc_lib/revision/revision.php b/include/inc_lib/revision/revision.php
@@ -10,5 +10,5 @@
  **/
 
 define('PHPWCMS_VERSION', '1.9.26');
-define('PHPWCMS_RELEASE_DATE', '2021/08/14');
+define('PHPWCMS_RELEASE_DATE', '2021/08/19');
 define('PHPWCMS_REVISION', '552');
diff --git a/include/vendor/autoload.php b/include/vendor/autoload.php
@@ -0,0 +1,7 @@
+<?php
+
+// autoload.php @generated by Composer
+
+require_once __DIR__ . '/composer/autoload_real.php';
+
+return ComposerAutoloaderInitd9d8a20757697aec57dc4639fa16142e::getLoader();