t3g / svg-sanitizer
Sanitize SVG files on upload
Installs: 20 767
Dependents: 0
Suggesters: 0
Security: 1
Stars: 3
Watchers: 7
Forks: 2
Open Issues: 2
Type:typo3-cms-extension
Requires
- enshrined/svg-sanitize: ^0.13.3
- typo3/cms-core: ^8.7.13 || ^9.2 || ^10.1
- typo3/cms-extbase: ^8.7.13 || ^9.2 || ^10.1
- typo3/cms-install: ^8.7.13 || ^9.2 || ^10.1
Requires (Dev)
- bk2k/extension-helper: ^1.0
- friendsofphp/php-cs-fixer: ^2.14
- overtrue/phplint: ^1.1
- roave/security-advisories: dev-master
- typo3/testing-framework: ^2 || ^4.9 || ^5.0 || ^6.2
Replaces
- t3g/svg_sanitizer: 1.0.3
This package is auto-updated.
Last update: 2023-10-18 08:26:11 UTC
README
This extension will sanitize any SVG file uploaded to the TYPO3 system, but only with the default options. Please read the following section carefully for all details.
Important to know
This extension removes all script and data values in attributes. This means that, for example, embedded graphics such as PNGs are also removed:
// before parser
<image width="100" height="100" xlink:href="data:image/png;base64,xxxx"/>
// after parser
<image width="100" height="100" />
What this extension does
- Hooks into FAL API:
ResourceFactory::addFile()
andResourceFactory::replaceFile()
- Hooks into FAL API:
ResourceStorage::setFileContents()
- Hooks into DataHandler: Handling files for group/select function
- Hooks into
GeneralUtility::upload_copy_move()
- Hooks into
GeneralUtility::upload_to_tempfile()
- Provide an upgrade wizard for existing SVG files (please read the warnings in the upgrade wizard carefully)
WARNING
This extension can only sanitize the files if the upload is done in one of the ways described above. For example, if a third-party extension allows to upload files and does not use the core APIs described above, SVG Sanitizer cannot sanitize these files.
Credits
Thanks to Daryll Doyle and his svg-sanitizer library
Bundling PHAR of external library
The process of bundling a composer package into a dedicated PHAR archive has been taken from blog post "How to use PHP libraries in legacy extensions".
First install bundler package clue/phar-composer
globally
composer global require clue/phar-composer
Then inside the extension folder create the PHAR archive
(in case global composer binaries are not part of the PATH environment, it's
possible to invoke ~/.composer/vendor/bin/phar-composer)
directly)
cd typo3conf/ext/svg_sanitizer
phar-composer build enshrined/svg-sanitize Libraries/enshrined-svg-sanitize.phar
Issue Reporting
Please report any issues with the extension at Github.