[TASK] Introduce SVG Sanitizer
This change introduces behavior of extension `t3g/svg-sanitizer` into the TYPO3 core. Sanitizing SVG data is actually done by external package `enshrined/svg-sanitize` by Daryll Doyle. The following aspects are introduced: + handle `GeneralUtility::upload_copy_move` invocations + handle FAL action events `file-add`, `file-replace`, `set-content` + provide upgrade wizard, sanitizing all SVG files in storages that are using `LocalDriver` Custom usage: ``` $sanitizer = new \TYPO3\CMS\Core\Resource\Security\SvgSanitizer(); $sanitizer->sanitizeFile($sourcePath, $targetPath); $svg = $sanitizer->sanitizeContent($svg); ``` Basically this change enforces following public service announcements concerning SVG files, to enhance these security aspects per default: + https://typo3.org/security/advisory/typo3-psa-2020-003 + https://typo3.org/security/advisory/typo3-psa-2019-010 Resolves: #94492 Releases: master, 10.4, 9.5 Change-Id: I42c206190d8a335ebaf77b7e5d57b383e3bcbae1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69809 Tested-by:core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
Showing
- composer.json 1 addition, 0 deletionscomposer.json
- composer.lock 46 additions, 1 deletioncomposer.lock
- typo3/sysext/core/Classes/Resource/Security/SvgEventListener.php 72 additions, 0 deletions...ysext/core/Classes/Resource/Security/SvgEventListener.php
- typo3/sysext/core/Classes/Resource/Security/SvgHookHandler.php 48 additions, 0 deletions.../sysext/core/Classes/Resource/Security/SvgHookHandler.php
- typo3/sysext/core/Classes/Resource/Security/SvgSanitizer.php 56 additions, 0 deletionstypo3/sysext/core/Classes/Resource/Security/SvgSanitizer.php
- typo3/sysext/core/Classes/Resource/Security/SvgTypeCheck.php 76 additions, 0 deletionstypo3/sysext/core/Classes/Resource/Security/SvgTypeCheck.php
- typo3/sysext/core/Configuration/Services.yaml 21 additions, 0 deletionstypo3/sysext/core/Configuration/Services.yaml
- typo3/sysext/core/Documentation/Changelog/9.5.x/Important-94492-IntroduceSVGSanitizer.rst 39 additions, 0 deletions...Changelog/9.5.x/Important-94492-IntroduceSVGSanitizer.rst
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Clean.svg 7 additions, 0 deletions...unctional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Clean.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Data.svg 8 additions, 0 deletions...Functional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Data.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Script.svg 7 additions, 0 deletions...nctional/Resource/Fixtures/CleanSVG/TYPO3_Logo_Script.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/ariaData.svg 57 additions, 0 deletions.../Tests/Functional/Resource/Fixtures/CleanSVG/ariaData.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/billion_laughs.svg 0 additions, 0 deletions.../Functional/Resource/Fixtures/CleanSVG/billion_laughs.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/entity.svg 4 additions, 0 deletions...re/Tests/Functional/Resource/Fixtures/CleanSVG/entity.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/entity_2.svg 4 additions, 0 deletions.../Tests/Functional/Resource/Fixtures/CleanSVG/entity_2.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/external.svg 10 additions, 0 deletions.../Tests/Functional/Resource/Fixtures/CleanSVG/external.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/hrefOne.svg 13 additions, 0 deletions...e/Tests/Functional/Resource/Fixtures/CleanSVG/hrefOne.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/hrefTwo.svg 13 additions, 0 deletions...e/Tests/Functional/Resource/Fixtures/CleanSVG/hrefTwo.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/html.svg 4 additions, 0 deletions...core/Tests/Functional/Resource/Fixtures/CleanSVG/html.svg
- typo3/sysext/core/Tests/Functional/Resource/Fixtures/CleanSVG/simple.svg 4 additions, 0 deletions...re/Tests/Functional/Resource/Fixtures/CleanSVG/simple.svg
Please register or sign in to comment