Skip to content

fix: harden SVG sanitization against XSS vectors#1899

Merged
JhaSourav07 merged 1 commit into
JhaSourav07:mainfrom
TanCodeX:fix/svg-sanitization-security
May 30, 2026
Merged

fix: harden SVG sanitization against XSS vectors#1899
JhaSourav07 merged 1 commit into
JhaSourav07:mainfrom
TanCodeX:fix/svg-sanitization-security

Conversation

@TanCodeX
Copy link
Copy Markdown
Contributor

Description

Fixes #1897

Replaces the existing regex-based SVG sanitization in page.tsx with a more secure sanitization approach.

Changes

  • Removed reliance on regex-only sanitization for SVG content.
  • Added support for sanitizer-based SVG filtering with an allowlist of safe elements and attributes.
  • Prevented common SVG XSS vectors, including:
    • foreignObject
    • xlink:href abuse
    • unsafe data: URIs
    • CSS url() injections
    • inline event handlers
  • Improved overall SVG rendering security through defense-in-depth practices and safer content handling.

Pillar

  • 🎨 Pillar 1 — New Theme Design
  • 📐 Pillar 2 — Geometric SVG Improvement
  • 🕐 Pillar 3 — Timezone Logic Optimization
  • 🛠️ Other (Bug fix, refactoring, docs)

Checklist before requesting a review:

  • I have read the CONTRIBUTING.md file.
  • I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
  • I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
  • My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
  • I have updated README.md if I added a new theme or URL parameter.
  • I have started the repo.
  • I have made sure that i have only one commit to merge in this PR.
  • The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
  • (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

Copilot AI review requested due to automatic review settings May 30, 2026 20:48
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented May 30, 2026

@TanCodeX is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

@JhaSourav07 JhaSourav07 merged commit c7d423b into JhaSourav07:main May 30, 2026
5 of 6 checks passed
@github-actions
Copy link
Copy Markdown

🎉 Congratulations @TanCodeX! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨

@JhaSourav07 JhaSourav07 added GSSoC 2026 level:beginner Small changes Usually isolated fixes or simple UI/text updates. quality:exceptional Outstanding contribution with exceptional implementation quality, testing. gssoc:approved PR has been reviewed and accepted for valid contribution points mentor:Aamod007 labels May 30, 2026
@github-actions github-actions Bot added this to the GSSoC 2026 milestone May 30, 2026
@TanCodeX TanCodeX review requested due to automatic review settings May 30, 2026 21:12
@github-actions github-actions Bot added the type:bug Something isn't working as expected label Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc:approved PR has been reviewed and accepted for valid contribution points GSSoC 2026 level:beginner Small changes Usually isolated fixes or simple UI/text updates. mentor:Aamod007 quality:exceptional Outstanding contribution with exceptional implementation quality, testing. type:bug Something isn't working as expected

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: regex-based SVG sanitization is vulnerable to XSS bypasses

2 participants