Fixed: Secure the uploads
In previous comment, to prevent linked images inside SVG I used xlink:href
That's no good, it must be followed by <<="http">>, this does it. Else a lot
of SVP images would not be loadable. Because xlink:href can be used in other
cases.
@@ -654,7 +654,7 @@ public class SecuredUpload {
}
}
String content = new String(bytesFromFile);
- if (content.toLowerCase().contains("xlink:href")) {
+ if (content.toLowerCase().contains("xlink:href=\"http")) {
Debug.logError("Linked images inside SVG are not allowed for security reason", MODULE);
return false;
}
