Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
qurantine bad SVGs
  • Loading branch information
rhukster committed Jul 1, 2021
1 parent 9aa6f5b commit 8af1229
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 2 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Expand Up @@ -3,6 +3,7 @@

1. [](#improved)
* Added support for loading Flex Directory configuration from main configuration
* Move SVGs that cannot be sanitized to quarantine folder under `log://quarantine`
1. [](#bugfix)
* Fixed error when using Flex `SimpleStorage` with no entries
* Fixed page search to include slug field [#3316](https://github.com/getgrav/grav/issues/3316)
Expand Down
12 changes: 10 additions & 2 deletions system/src/Grav/Common/Security.php
Expand Up @@ -12,6 +12,7 @@
use enshrined\svgSanitize\Sanitizer;
use Exception;
use Grav\Common\Config\Config;
use Grav\Common\Filesystem\Folder;
use Grav\Common\Page\Pages;
use function chr;
use function count;
Expand Down Expand Up @@ -56,9 +57,16 @@ public static function sanitizeSVG(string $file): void
$original_svg = file_get_contents($file);
$clean_svg = $sanitizer->sanitize($original_svg);

// TODO: what to do with bad SVG files which return false?
if ($clean_svg !== false && $clean_svg !== $original_svg) {
// Quarantine bad SVG files and throw exception
if ($clean_svg !== false ) {
file_put_contents($file, $clean_svg);
} else {
$quarantine_file = basename($file);
$quarantine_dir = 'log://quarantine';
Folder::mkdir($quarantine_dir);
file_put_contents("$quarantine_dir/$quarantine_file", $original_svg);
unlink($file);
throw new Exception('SVG could not be sanitized, it has been moved to the logs/quarantine folder');
}
}
}
Expand Down

0 comments on commit 8af1229

Please sign in to comment.