Description

Preserve XML structural entities during decode when exporting SVG.

Changes

• Update htmlEntityDecode to preserve the five XML structural entities (&, ", ', <, >) in named, decimal, and hex numeric forms instead of decoding them
• Add tests to check if entities are preserved decoding

Testing

• Be on master
• Open Plotly devtools
• In browser devtools, enter the following in the console:

  const fig = {
    data: [{ x: [1], y: [1], type: "scatter" }],
    layout: {
      annotations: [
        {
          x: 1,
          y: 1,
          showarrow: false,
          text: '<span style="x:&#34; onmouseover=&#34;alert(1)&#34; a=&#34;">Zoidberg</span>',
        },
      ],
    },
  };
  
  Plotly.newPlot(gd, fig)
    .then(() =>
      Plotly.toImage(gd, {
        format: "svg",
        imageDataOnly: true,
      }),
    )
    .then((svg) => console.log(decodeURIComponent(svg)));

• Toward the end of the log statement, note that onmouseover has been injected into the SVG as an attribute
• Switch to this branch
• Go through the same process
• Toward the end of the log statement, note that onmouseover is only part of the style attribute

Notes

• Attack path. htmlEntityDecode in tosvg.js ran after XMLSerializer.serializeToString and decoded &quot; / &#34; / &#x22; back to literal " chars in attribute values the serializer had safely escaped, letting the payload break out of style="..." and inject arbitrary attributes (onmouseover=, onclick=, …).
• Affected callers. Plotly.toImage, Plotly.downloadImage, and downstream products that embed user-authored figure SVG into a privileged origin (shared-plot previews, dashboards, exported-image galleries).
• Non-browser SVG renderers. htmlEntityDecode exists partly so exported SVG renders correctly in Batik / Illustrator / kaleido (for PDF/EPS). The fix preserves five more entities in the output; SVG is still valid XML.
• References:
  • XML 1.0 §4.6 – Predefined Entities
  • WHATWG DOM-Parsing – XMLSerializer