# detect-svg-scripts

A library for detecting scripts (eg. Javascript) inside of SVG files. Useful when building tools that should disallow script-containing SVGs, like security tooling.

Currently, this library detects:
- Inline `<script>` tags
- External `<script src="...">` references
- `on*` event handler attributes

If you know of another place where scripts can occur within SVGs, please open an issue or PR!

## License, donations, and other boilerplate

Licensed under either the [WTFPL](http://www.wtfpl.net/txt/copying/) or [CC0](https://creativecommons.org/publicdomain/zero/1.0/), at your choice. In practice, that means it's more or less public domain, and you can do whatever you want with it. Giving credit is *not* required, but still very much appreciated! I'd love to [hear from you](mailto:admin@cryto.net) if this module was useful to you.

Creating and maintaining open-source modules is a lot of work. A donation is also not required, but much appreciated! You can donate [here](http://cryto.net/~joepie91/donate.html).

## Example

A runnable version of this example can be found in `example.js` in the repository.

```js
"use strict";

const Promise = require("bluebird");
const fs = require("fs");
const path = require("path");
const detectSVGScripts = require("detect-svg-scripts");

Promise.try(() => {
	return detectSVGScripts(fs.createReadStream(path.join(__dirname, "test-svg/clock.svg")));
}).then((result) => {
	console.log(result); /*
		[
			{
				type: 'inlineScriptTag',
				tag: { name: 'SCRIPT', attributes: [Object], isSelfClosing: false }
			}
		]
	*/

	return fs.promises.readFile(path.join(__dirname, "test-svg/wpt.svg"));
}).then((buffer) => {
	return detectSVGScripts(buffer);
}).then((result) => {
	console.log(result); /*
		[
			{
				type: 'eventHandler',
				tag: { name: 'SVG', attributes: [Object], isSelfClosing: false },
				attribute: 'onload'
			},
			{
				type: 'inlineScriptTag',
				tag: { name: 'SCRIPT', attributes: [Object], isSelfClosing: false }
			}
		]
	*/
});

```

## API

### detectSVGScripts(source)

Scans the given `source` SVG content for scripts.

- __source:__ The SVG to scan, as either a string, buffer, or readable Node.js stream.

Returns a Promise that resolves to an array of found scripts. Each item includes some metadata, and there are various `type`s:

- __eventHandler:__ Inline event handler, like an `onclick` property. The `attribute` property specifies the name of the handler.
- __inlineScriptTag:__ Inline `<script>` block. No additional metadata is included.
- __externalScriptFile:__ A `<script src="...">` tag, ie. one that references an external file. The `file` property specifies the path of that file.

The Promise may also reject, with any of the errors that could be caused by [sax](https://www.npmjs.com/package/sax) (which unfortunately doesn't document the possible errors).