25'ten fazla konu seçemezsiniz Konular bir harf veya rakamla başlamalı, kısa çizgiler ('-') içerebilir ve en fazla 35 karakter uzunluğunda olabilir.
 
Sven Slootweg 6999555dc4 Initial commit 4 yıl önce
test-svg Initial commit 4 yıl önce
.eslintrc Initial commit 4 yıl önce
.gitignore Initial commit 4 yıl önce
README.md Initial commit 4 yıl önce
example.js Initial commit 4 yıl önce
index.js Initial commit 4 yıl önce
package.json Initial commit 4 yıl önce
yarn.lock Initial commit 4 yıl önce

README.md

detect-svg-scripts

A library for detecting scripts (eg. Javascript) inside of SVG files. Useful when building tools that should disallow script-containing SVGs, like security tooling.

Currently, this library detects:

  • Inline <script> tags
  • External <script src="..."> references
  • on* event handler attributes

If you know of another place where scripts can occur within SVGs, please open an issue or PR!

License, donations, and other boilerplate

Licensed under either the WTFPL or CC0, at your choice. In practice, that means it's more or less public domain, and you can do whatever you want with it. Giving credit is not required, but still very much appreciated! I'd love to hear from you if this module was useful to you.

Creating and maintaining open-source modules is a lot of work. A donation is also not required, but much appreciated! You can donate here.

Example

A runnable version of this example can be found in example.js in the repository.

"use strict";

const Promise = require("bluebird");
const fs = require("fs");
const path = require("path");
const detectSVGScripts = require("detect-svg-scripts");

Promise.try(() => {
	return detectSVGScripts(fs.createReadStream(path.join(__dirname, "test-svg/clock.svg")));
}).then((result) => {
	console.log(result); /*
		[
			{
				type: 'inlineScriptTag',
				tag: { name: 'SCRIPT', attributes: [Object], isSelfClosing: false }
			}
		]
	*/

	return fs.promises.readFile(path.join(__dirname, "test-svg/wpt.svg"));
}).then((buffer) => {
	return detectSVGScripts(buffer);
}).then((result) => {
	console.log(result); /*
		[
			{
				type: 'eventHandler',
				tag: { name: 'SVG', attributes: [Object], isSelfClosing: false },
				attribute: 'onload'
			},
			{
				type: 'inlineScriptTag',
				tag: { name: 'SCRIPT', attributes: [Object], isSelfClosing: false }
			}
		]
	*/
});

API

detectSVGScripts(source)

Scans the given source SVG content for scripts.

  • source: The SVG to scan, as either a string, buffer, or readable Node.js stream.

Returns a Promise that resolves to an array of found scripts. Each item includes some metadata, and there are various types:

  • eventHandler: Inline event handler, like an onclick property. The attribute property specifies the name of the handler.
  • inlineScriptTag: Inline <script> block. No additional metadata is included.
  • externalScriptFile: A <script src="..."> tag, ie. one that references an external file. The file property specifies the path of that file.

The Promise may also reject, with any of the errors that could be caused by sax (which unfortunately doesn't document the possible errors).