From f86ddfd36538667cd0c484a62825569a36ef2a2c Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 12 Sep 2015 20:54:06 -0700
Subject: Render sanitized SVG images

Closes https://github.com/gitlabhq/gitlabhq/issues/9265
---
 app/helpers/blob_helper.rb | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'app/helpers/blob_helper.rb')

diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb
index 694c03206bd..16967927922 100644
--- a/app/helpers/blob_helper.rb
+++ b/app/helpers/blob_helper.rb
@@ -126,4 +126,16 @@ module BlobHelper
       blob.size
     end
   end
+
+  def blob_svg?(blob)
+    blob.language && blob.language.name == 'SVG'
+  end
+
+  # SVGs can contain malicious JavaScript; only include whitelisted
+  # elements and attributes. Note that this whitelist is by no means complete
+  # and may omit some elements.
+  def sanitize_svg(blob)
+    blob.data = Loofah.scrub_fragment(blob.data, :strip).to_xml
+    blob
+  end
 end
-- 
cgit v1.2.1