FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
matplotlib/.svglintrc.mjs at main · mattgebert/matplotlib · GitHub
mattgebert
matplotlib
Repository navigation
Code
Pull requests
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
matplotlib
/
.svglintrc.mjs
Copy path
More file actions
More file actions
Latest commit
History
History
History
56 lines (52 loc) · 2.4 KB
Breadcrumbs
matplotlib
/
.svglintrc.mjs
Copy path
File metadata and controls
56 lines (52 loc) · 2.4 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
/**
@type
{
import('svglint').Config
} */
const
config
=
{
rules
:
{
// Ensure all SVGs are valid XML.
valid
:
true
,
// Block elements that can execute code or embed arbitrary content.
// <script> can run arbitrary JavaScript; <foreignObject> and <iframe>
// can embed arbitrary HTML. Unlike event-handler attributes (which
// are a legitimate tool for matplotlib's interactive SVG examples),
// there is no use case in this repository for these elements outside
// of a <script> already paired with its own exemption.
elm
:
{
"script"
:
false
,
"foreignObject"
:
false
,
"iframe"
:
false
,
}
,
custom
:
[
// Block external URL references in href / xlink:href.
// Internal fragment references (#id), data: URIs, and relative
// paths are all fine. http/https/ftp and protocol-relative URLs
// are blocked because they cause the SVG renderer to make an
// outbound network request, leaking the viewer's IP and UA to an
// attacker-controlled server.
(
reporter
,
$
,
_ast
)
=>
{
reporter
.
name
=
"no-external-references"
;
const
externalPattern
=
/
^
(
h
t
t
p
s
?
:
|
f
t
p
:
|
\/
\/
)
/
i
;
$
(
"[href], [xlink\\:href]"
)
.
each
(
(
_i
,
el
)
=>
{
if
(
!
el
.
attribs
)
{
return
;
}
const
href
=
el
.
attribs
[
"href"
]
??
el
.
attribs
[
"xlink:href"
]
;
if
(
href
&&
externalPattern
.
test
(
href
)
)
{
reporter
.
error
(
`Found external reference '
${
href
}
' on <
${
el
.
name
}
>. `
+
"External URL references in SVGs cause the renderer "
+
"to make an outbound request, leaking viewer IP/UA."
)
;
}
}
)
;
}
,
]
,
}
,
// These four files are intentional interactive SVG examples that
// demonstrate matplotlib's SVG interactivity features. They contain
// embedded ECMAScript by design and are exempted from the <script> rule.
ignore
:
[
"doc/_static/svg_histogram.svg"
,
"doc/_static/svg_tooltip.svg"
,
"galleries/examples/user_interfaces/images/svg_histogram.svg"
,
"galleries/examples/user_interfaces/images/svg_tooltip.svg"
,
]
,
}
;
export
default
config
;
Back
|
FazBrowse Home
|
New Git URL