Skip to content

7.25.15

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jun 07:25
v7.25.15
d870d05
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@comet/cms-api@7.25.15

Patch Changes

  • 61d21ec: Validate uploaded SVGs with DOMPurify (backed by jsdom) instead of the custom XML-based check

    The previous implementation parsed SVGs with fast-xml-parser and applied a hand-written allow/deny list to reject scripts, event handlers and unsafe links.
    SVGs are now sanitized with the vetted DOMPurify library and rejected when it has to strip any tags or attributes, providing more robust protection against XSS vectors in uploaded SVGs.

    The role attribute and the <use> element are allowed, since they're commonly used in valid SVGs. <use> is restricted to same-document fragment references (e.g. href="#id"); references to external resources are rejected to prevent XSS/SSRF.

Assets 2
Loading