jyapayne/dify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: sanitizer svg to avoid xss (#16606)

Browse source
This commit is contained in:
Joel 2025-03-24 14:36:07 +08:00 • committed by GitHub
commit 16b6ffd915
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 21 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

3
web/app/components/base/svg-gallery/index.tsx
View file

@ -1,6 +1,7 @@
import { useEffect, useRef, useState } from 'react'
import { SVG } from '@svgdotjs/svg.js'
import ImagePreview from '@/app/components/base/image-uploader/image-preview'
import DOMPurify from 'dompurify'
export const SVGRenderer = ({ content }: { content: string }) => {
const svgRef = useRef<HTMLDivElement>(null)
@ -44,7 +45,7 @@ export const SVGRenderer = ({ content }: { content: string }) => {
svgRef.current.style.width = `${Math.min(originalWidth, 298)}px`
const rootElement = draw.svg(content)
const rootElement = draw.svg(DOMPurify.sanitize(content))
rootElement.click(() => {
setImagePreview(svgToDataURL(svgElement as Element))