fix: replace regular expression with two replacements to avoid ReDoS,…

… simplify the test cases.
svg · Apr 25, 2024 · 42e272e · 42e272e
1 parent fa214e7
commit 42e272e
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 10 deletions.
diff --git a/plugins/cleanupIds.js b/plugins/cleanupIds.js
@@ -232,10 +232,9 @@ export const fn = (_root, params) => {
                 const value = element.attributes[name];
                 if (value.includes('#')) {
                   // replace id in href and url()
-                  element.attributes[name] = value.replace(
-                    new RegExp(`#(${id}|${encodeURI(id)})`),
-                    `#${currentIdString}`,
-                  );
+                  element.attributes[name] = value
+                    .replace(`#${encodeURI(id)}`, `#${currentIdString}`)
+                    .replace(`#${id}`, `#${currentIdString}`);
                 } else {
                   // replace id in begin attribute
                   element.attributes[name] = value.replace(

diff --git a/test/plugins/cleanupIds.26.svg.txt b/test/plugins/cleanupIds.26.svg.txt
@@ -7,9 +7,7 @@ See: https://github.com/svg/svgo/issues/1981
 <svg xmlns="http://www.w3.org/2000/svg">
     <defs>
         <linearGradient id="渐变_1" x1="0%" y1="0%" x2="100%" y2="0%">
-			      <stop offset="10%" stop-color="#c71700" />
-            <stop offset="60%" stop-color="orange" />
-            <stop offset="100%" stop-color="#5a2100" />
+            <stop stop-color="#5a2100" />
         </linearGradient>
     </defs>
     <rect x="30" y="30" height="150" width="370" fill="url(#渐变_1)" />
@@ -20,9 +18,7 @@ See: https://github.com/svg/svgo/issues/1981
 <svg xmlns="http://www.w3.org/2000/svg">
     <defs>
         <linearGradient id="a" x1="0%" y1="0%" x2="100%" y2="0%">
-            <stop offset="10%" stop-color="#c71700"/>
-            <stop offset="60%" stop-color="orange"/>
-            <stop offset="100%" stop-color="#5a2100"/>
+            <stop stop-color="#5a2100"/>
         </linearGradient>
     </defs>
     <rect x="30" y="30" height="150" width="370" fill="url(#a)"/>