Skip to content

Commit

Permalink
fix(removeScriptElement): remove link anchors with scripts
Browse files Browse the repository at this point in the history
  • Loading branch information
SethFalco committed Oct 5, 2023
1 parent e529c66 commit a3cf96d
Show file tree
Hide file tree
Showing 4 changed files with 62 additions and 3 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ const config = await loadConfig(configFile, cwd);
| [removeNonInheritableGroupAttrs](https://github.com/svg/svgo/blob/main/plugins/removeNonInheritableGroupAttrs.js) | remove non-inheritable group's "presentation" attributes | Yes |
| [removeOffCanvasPaths](https://github.com/svg/svgo/blob/main/plugins/removeOffCanvasPaths.js) | removes elements that are drawn outside of the viewbox | |
| [removeRasterImages](https://github.com/svg/svgo/blob/main/plugins/removeRasterImages.js) | remove raster images | |
| [removeScriptElement](https://github.com/svg/svgo/blob/main/plugins/removeScriptElement.js) | remove `<script>` elements | |
| [removeScriptElement](https://github.com/svg/svgo/blob/main/plugins/removeScriptElement.js) | remove scripts | |
| [removeStyleElement](https://github.com/svg/svgo/blob/main/plugins/removeStyleElement.js) | remove `<style>` elements | |
| [removeTitle](https://github.com/svg/svgo/blob/main/plugins/removeTitle.js) | remove `<title>` | Yes |
| [removeUnknownsAndDefaults](https://github.com/svg/svgo/blob/main/plugins/removeUnknownsAndDefaults.js) | remove unknown elements content and attributes, remove attributes with default values | Yes |
Expand Down
31 changes: 29 additions & 2 deletions plugins/removeScriptElement.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@
const { detachNodeFromParent } = require('../lib/xast.js');

exports.name = 'removeScriptElement';
exports.description = 'removes <script> elements (disabled by default)';
exports.description = 'removes scripts (disabled by default)';

/**
* Remove <script>.
* Remove scripts.
*
* https://www.w3.org/TR/SVG11/script.html
*
Expand All @@ -20,6 +20,33 @@ exports.fn = () => {
enter: (node, parentNode) => {
if (node.name === 'script') {
detachNodeFromParent(node, parentNode);
return;
}

if (
node.name === 'a' &&
node.attributes.href != null
) {
try {
const url = new URL(node.attributes.href);
if (url.protocol !== 'javascript:') {
return;
}
} catch (err) {
return;
}

detachNodeFromParent(node, parentNode);
const index = parentNode.children.indexOf(node);
parentNode.children.splice(index, 1, ...node.children);

// TODO remove legacy parentNode in v4
for (const child of node.children) {
Object.defineProperty(child, 'parentNode', {
writable: true,
value: parentNode,
});
}
}
},
},
Expand Down
15 changes: 15 additions & 0 deletions test/plugins/removeScriptElement.02.svg
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
17 changes: 17 additions & 0 deletions test/plugins/removeScriptElement.03.svg
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit a3cf96d

Please sign in to comment.