This release allows enshrined/svg-sanitize 1.0, which fixes GHSA-9rjx-3jch-6vjf, GHSA-m9xh-6747-9r6f and GHSA-v383-3rw5-q8rf. Upgrading is recommended for every 5.x install. Composer now refuses to install 0.22.0 by default, so without this release composer update is blocked in apps using Curator.
Changed
enshrined/svg-sanitizeconstraint widened to^0.22|^1.0.- The 1.0 API is unchanged, so no code changes are needed.
- SVG sanitizing is stricter.
- Remote
@importandurl()references inside an SVG's<style>are now stripped. - An SVG's DOCTYPE is removed before parsing. SVGs that rely on entities declared there no longer parse, so they're rejected at upload and nothing is stored. This includes older Adobe Illustrator exports that write
xmlns="&ns_svg;". - To upload one, re-export it without the DOCTYPE, or remove the DOCTYPE and replace the entities with their values.
curator:sanitize-svgsskips stored SVGs it can't sanitize and leaves them unchanged.
- Remote
Added in #772.
What's Changed
- chore: allow enshrined/svg-sanitize 1.0 by @tatrabusiness in #772
New Contributors
- @tatrabusiness made their first contribution in #772
Full Changelog: v5.5.3...v5.5.4