Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: SVG sanitization for file uploaded with 'sideload' action #2406

Merged
merged 1 commit into from
Oct 28, 2024

Conversation

Soare-Robert-Daniel
Copy link
Contributor

@Soare-Robert-Daniel Soare-Robert-Daniel commented Oct 25, 2024

Closes https://github.com/Codeinwp/otter-internals/issues/242

Summary

The sanitize function was already added for wp_handle_upload_prefilter, but the files uploaded via the WP rest endpoint for media triggered this filter.

On closer inspection of the endpoint source code, instead of upload, it was using a sideload action. Thus, I also included it as a part of the filter wp_handle_sideload_prefilter.

Besides this, the filename will have a random suffix attached per recommendations.

  • The test has been updated for the new behavior.
  • Added a new test for non-SVG files with the world's smallest png file.

Screenshots

image


Checklist before the final review

  • Included E2E or unit tests for the changes in this PR.
  • Visual elements are not affected by independent changes.
  • It is at least compatible with the minimum WordPress version.
  • It loads additional script in frontend only if it is required.
  • Does not impact the Core Web Vitals.
  • In case of deprecation, old blocks are safely migrated.
  • It is usable in Widgets and FSE.
  • Copy/Paste is working if the attributes are modified.
  • PR is following the best practices

@Soare-Robert-Daniel Soare-Robert-Daniel self-assigned this Oct 25, 2024
@pirate-bot pirate-bot added the pr-checklist-complete The Pull Request checklist is complete. (automatic label) label Oct 25, 2024
@pirate-bot
Copy link
Contributor

Bundle Size Diff

Package Old Size New Size Diff
Animations 271.41 KB 271.41 KB 0 B (0.00%)
Blocks 1.56 MB 1.56 MB 0 B (0.00%)
CSS 100.89 KB 100.89 KB 0 B (0.00%)
Dashboard 198.45 KB 198.45 KB 0 B (0.00%)
Onboarding 161.1 KB 161.1 KB 0 B (0.00%)
Export Import 97.78 KB 97.78 KB 0 B (0.00%)
Pro 423.27 KB 423.27 KB 0 B (0.00%)

@pirate-bot
Copy link
Contributor

pirate-bot commented Oct 25, 2024

Plugin build for 96ddd15 is ready 🛎️!

@pirate-bot
Copy link
Contributor

pirate-bot commented Oct 25, 2024

E2E Tests

Playwright Test Status:

Performance Results serverResponse: 239.95, firstPaint: 551.75, domContentLoaded: 1570, loaded: 1570.75, firstContentfulPaint: 3554.55, firstBlock: 7974.55, type: 13.2, minType: 11.97, maxType: 15.28, typeContainer: 9.71, minTypeContainer: 7.4, maxTypeContainer: 12.26, focus: 34.21, minFocus: 30.39, maxFocus: 42.92, inserterOpen: 23.27, minInserterOpen: 20.96, maxInserterOpen: 27.94, inserterSearch: 0.92, minInserterSearch: 0.77, maxInserterSearch: 1.13, inserterHover: 3.08, minInserterHover: 2.61, maxInserterHover: 4.46, listViewOpen: 151.03, minListViewOpen: 137.15, maxListViewOpen: 173.84

@vytisbulkevicius vytisbulkevicius merged commit 9a50667 into development Oct 28, 2024
11 checks passed
@vytisbulkevicius vytisbulkevicius deleted the fix/security branch October 28, 2024 22:45
@pirate-bot
Copy link
Contributor

🎉 This PR is included in version 3.0.5 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@pirate-bot pirate-bot added the released Indicate that an issue has been resolved and released in a particular version of the product. label Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pr-checklist-complete The Pull Request checklist is complete. (automatic label) released Indicate that an issue has been resolved and released in a particular version of the product.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants