fix: svg sanatize.

Author: suraj-webkul

packages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php

@@ -2,6 +2,8 @@
 
 namespace Webkul\Admin\Http\Controllers;
 
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Storage;
 use Webkul\Core\Traits\Sanitizer;
 
@@ -11,17 +13,13 @@ class TinyMCEController extends Controller
 
     /**
      * Storage folder path.
-     *
-     * @var string
      */
-    private $storagePath = 'tinymce';
+    private string $storagePath = 'tinymce';
 
     /**
      * Upload file from tinymce.
-     *
-     * @return void
      */
-    public function upload()
+    public function upload(): JsonResponse
     {
         $media = $this->storeMedia();
 
@@ -36,20 +34,24 @@ public function upload()
 
     /**
      * Store media.
-     *
-     * @return array
      */
-    public function storeMedia()
+    public function storeMedia(): array
     {
         if (! request()->hasFile('file')) {
             return [];
         }
 
         $file = request()->file('file');
 
-        $path = $file->store($this->storagePath);
+        if (! $file instanceof UploadedFile) {
+            return [];
+        }
+
+        $filename = md5($file->getClientOriginalName().time()).'.'.$file->getClientOriginalExtension();
+
+        $path = $file->storeAs($this->storagePath, $filename);
 
-        $this->sanitizeSVG($path, $file->getMimeType());
+        $this->sanitizeSVG($path, $file);
 
         return [
             'file'      => $path,

packages/Webkul/Core/src/Traits/Sanitizer.php

@@ -2,47 +2,80 @@
 
 namespace Webkul\Core\Traits;
 
+use enshrined\svgSanitize\data\AllowedAttributes;
+use enshrined\svgSanitize\data\AllowedTags;
 use enshrined\svgSanitize\Sanitizer as MainSanitizer;
+use Exception;
+use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Storage;
 
+/**
+ * Trait for sanitizing SVG uploads to prevent security vulnerabilities.
+ */
 trait Sanitizer
 {
     /**
-     * List of mime types which needs to check.
+     * Sanitize an SVG file to remove potentially malicious content.
      */
-    public $mimeTypes = [
-        'image/svg',
-        'image/svg+xml',
-    ];
-
-    /**
-     * Sanitize SVG file.
-     *
-     * @param  string  $path
-     * @return void
-     */
-    public function sanitizeSVG($path, $mimeType)
+    public function sanitizeSvg(string $path, UploadedFile $file): void
     {
-        if ($this->checkMimeType($mimeType)) {
-            /* sanitizer instance */
+        if (! $this->isSvgFile($file)) {
+            return;
+        }
+
+        try {
+            $svgContent = Storage::get($path);
+
+            if (! $svgContent) {
+                return;
+            }
+
             $sanitizer = new MainSanitizer;
+            $sanitizer->setAllowedAttrs(new AllowedAttributes);
+            $sanitizer->setAllowedTags(new AllowedTags);
+
+            $sanitizer->minify(true);
+            $sanitizer->removeRemoteReferences(true);
+            $sanitizer->removeXMLTag(true);
+
+            $sanitizer->setXMLOptions(LIBXML_NONET | LIBXML_NOBLANKS);
+
+            $sanitizedContent = $sanitizer->sanitize($svgContent);
+
+            if ($sanitizedContent === false) {
+                $patterns = [
+                    '/<script\b[^>]*>(.*?)<\/script>/is',
+                    '/\bon\w+\s*=\s*["\'][^"\']*["\']/i',
+                    '/javascript\s*:/i',
+                    '/data\s*:[^,]*base64/i',
+                ];
+
+                $sanitizedContent = $svgContent;
+
+                foreach ($patterns as $pattern) {
+                    $sanitizedContent = preg_replace($pattern, '', $sanitizedContent);
+                }
+
+                Storage::put($path, $sanitizedContent);
+
+                return;
+            }
+
+            $sanitizedContent = preg_replace('/(<script.*?>.*?<\/script>)|(\son\w+\s*=\s*["\'][^"\']*["\'])/is', '', $sanitizedContent);
 
-            /* grab svg file */
-            $dirtySVG = Storage::get($path);
+            Storage::put($path, $sanitizedContent);
+        } catch (Exception $e) {
+            report($e->getMessage());
 
-            /* save sanitized svg */
-            Storage::put($path, $sanitizer->sanitize($dirtySVG));
+            Storage::delete($path);
         }
     }
 
     /**
-     * Sanitize SVG file.
-     *
-     * @param  string  $path
-     * @return void
+     * Check if the uploaded file is an SVG based on both extension and mime type.
      */
-    public function checkMimeType($mimeType)
+    public function isSvgFile(UploadedFile $file): bool
     {
-        return in_array($mimeType, $this->mimeTypes);
+        return str_contains(strtolower($file->getClientOriginalExtension()), 'svg');
     }
 }