1385b8076e
Reviewers flagged the inline SVG preview as a regression from the
pre-PR data-URI <img> path: DOMPurify's default SVG profile keeps
<style> tags, style attributes, and <image>/<use> href targets, all
of which now reach the host Studio document because we mount the
sanitized SVG with dangerouslySetInnerHTML. That lets a model
response hide UI with body{display:none}, or beacon to attacker
URLs via <image href=...>.
Fix in two layers so a single regression cannot reopen the hole:
* Tighten SVG_PURIFY_CONFIG -- FORBID_TAGS adds style, image, use,
link, meta; FORBID_ATTR drops href, xlink:href, and style. The
surviving markup can no longer carry inline CSS or external
resource refs.
* Move SvgPreview into a sandbox='' iframe (no scripts, no
same-origin) with a default-src 'none' CSP. Even if a future
sanitizer pass leaks a URL-bearing attribute, the browser blocks
the request and the SVG cannot touch parent.document.
|
||
|---|---|---|
| .. | ||
| app | ||
| assets | ||
| components | ||
| config | ||
| features | ||
| hooks | ||
| lib | ||
| shared | ||
| stores | ||
| test-setup | ||
| types | ||
| utils | ||
| index.css | ||
| main.tsx | ||
| speech-recognition.d.ts | ||