use svg-sanitize to sanitize SVG files

composer.json

@@ -29,6 +29,7 @@
 		"ifixit/php-akismet"        : "1.*",
 		"google/recaptcha"          : "~1.1",
 		"dapphp/securimage"         : "3.6.*",
+		"enshrined/svg-sanitize"    : "0.8.2",
 
 		"bower-asset/jquery"         : "1.12.3",
 		"bower-asset/jquery-timeago" : "1.5.2",

ext/handle_svg/main.php

@@ -6,11 +6,19 @@
  * Description: Handle static SVG files. (No thumbnail is generated for SVG files)
  */
 
+use enshrined\svgSanitize\Sanitizer;
+
 class SVGFileHandler extends Extension {
 	public function onDataUpload(DataUploadEvent $event) {
 		if($this->supported_ext($event->type) && $this->check_contents($event->tmpname)) {
 			$hash = $event->hash;
-			move_upload_to_archive($event);
+
+			$sanitizer = new Sanitizer();
+			$sanitizer->removeRemoteReferences(true);
+			$dirtySVG = file_get_contents($event->tmpname);
+			$cleanSVG = $sanitizer->sanitize($dirtySVG);
+			file_put_contents(warehouse_path("images", $hash), $cleanSVG);
+
 			send_event(new ThumbnailGenerationEvent($event->hash, $event->type));
 			$image = $this->create_image_from_data(warehouse_path("images", $hash), $event->metadata);
 			if(is_null($image)) {
@@ -46,7 +54,12 @@ public function onPageRequest(PageRequestEvent $event) {
 
 			$page->set_type("image/svg+xml");
 			$page->set_mode("data");
-			$page->set_data(file_get_contents(warehouse_path("images", $hash)));
+
+			$sanitizer = new Sanitizer();
+			$sanitizer->removeRemoteReferences(true);
+			$dirtySVG = file_get_contents(warehouse_path("images", $hash));
+			$cleanSVG = $sanitizer->sanitize($dirtySVG);
+			$page->set_data($cleanSVG);
 		}
 	}
 

ext/handle_svg/test.php

@@ -10,5 +10,13 @@ public function testSVGHander() {
 		# FIXME: test that the thumb works
 		# FIXME: test that it gets displayed properly
 	}
+
+	public function testAbuiveSVG() {
+		$this->log_in_as_user();
+		$image_id = $this->post_image("tests/alert.svg", "something");
+		$this->get_page("post/view/$image_id");
+		$this->get_page("get_svg/$image_id");
+		$this->assert_no_content("script");
+	}
 }