CVE-2022-24429 (Other, published 2022-06-10T20:15Z)
Description: value: The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/neocotic/convert-svg
Files changed:
package.json
packages/convert-svg-core/README.md
packages/convert-svg-core/src/Converter.js
packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg
packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg
packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg
packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg
packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg
packages/convert-svg-to-jpeg/README.md
packages/convert-svg-to-png/README.md
packages/convert-svg-to-webp/README.md
Commit message: Remove all disallowed SVG element attributes

In a further attempt to reduce remote code injection attack vectors, all attributes except for a set of allowed standard attributes are removed from the SVG element before being converted. Deprecated attributes are included by default, however, these can also be removed by disabling the new `allowDeprecatedAttributes` option.


Vulnerable code:
In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new sub-directory for your
Take a look at the other packages in this directory to setup the new package directory. They are all very similar, by
design, as the you should just need to provide the minimal amount of information required to support your intended
output format.
Configure this in your `package.json` file and you're API is ready!
Configure this in your `package.json` file and you're CLI is ready!
 * Due constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to. This
 * is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
   * <code>input</code> can either be a SVG buffer or string.
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg')));
  [_sanitize](svg) {
    return svg.removeAttr('onload');
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewPort="0 0 1000 1000">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" enable-background="new 0 0 100 99.864" xml:space="preserve">
	 width="100px" height="100px" viewBox="206 206 100 100" enable-background="new 206 206 100 100" xml:space="preserve">
     width="148px" height="35px" viewBox="0.3 0 148 35" enable-background="new 0.3 0 148 35" xml:space="preserve">
	 width="505px" height="505px" viewBox="0 0 505 505" enable-background="new 0 0 505 505" xml:space="preserve">
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `quality`    | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |

Fixed code:
    "test:jpeg": "npm test -- --grep convert-svg-to-jpeg",
    "test:png": "npm test -- --grep convert-svg-to-png",
    "test:webp": "npm test -- --grep convert-svg-to-webp",
In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new subdirectory for your
Take a look at the other packages in this directory to set up the new package directory. They are all very similar, by
design, as you should just need to provide the minimal amount of information required to support your intended output
format.
Configure this in your `package.json` file and your API is ready!
Configure this in your `package.json` file and your CLI is ready!
const _allowedAttributeNames = Symbol('allowedAttributeNames');
const _allowedDeprecatedAttributeNames = Symbol('allowedDeprecatedAttributeNames');
const _isAttributeAllowed = Symbol('isAttributeAllowed');
 * Due to constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to.
 * This is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
    this[_allowedAttributeNames] = new Set([
      // Core
      'height',
      'preserveAspectRatio',
      'viewBox',
      'width',
      'x',
      'xmlns',
      'y',
      // Conditional Processing
      'requiredExtensions',
      'systemLanguage',
      // Presentation
      'clip-path',
      'clip-rule',
      'color',
      'color-interpolation',
      'cursor',
      'display',
      'fill',
      'fill-opacity',
      'fill-rule',
      'filter',
      'mask',
      'opacity',
      'overflow',
      'pointer-events',
      'shape-rendering',
      'stroke',
      'stroke-dasharray',
      'stroke-dashoffset',
      'stroke-linecap',
      'stroke-linejoin',
      'stroke-miterlimit',
      'stroke-opacity',
      'stroke-width',
      'style',
      'transform',
      'vector-effect',
      'visibility',
      // XML
      'xml:lang',
      'xmlns',
      'xmlns:xlink'
    ]);
    this[_allowedDeprecatedAttributeNames] = new Set([
      // Core
      'baseProfile',
      'version',
      'zoomAndPan',
      // Conditional Processing
      'requiredFeatures',
      // Presentation
      'clip',
      'color-rendering',
      'enable-background',
      // XML
      'xml:base',
      'xml:space'
    ]);
   * <code>input</code> can either be an SVG buffer or string.
   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
   *
   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
   *
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg'), options));
  [_isAttributeAllowed](attributeName, options) {
    return this[_allowedAttributeNames].has(attributeName) ||
      (options.allowDeprecatedAttributes && this[_allowedDeprecatedAttributeNames].has(attributeName));
  }

    if (typeof options.allowDeprecatedAttributes !== 'boolean') {
      options.allowDeprecatedAttributes = true;
    }

  [_sanitize](svg, options) {
    const attributeNames = Object.keys(svg.attr() || {});

    for (const attributeName of attributeNames) {
      if (!this[_isAttributeAllowed](attributeName, options)) {
        svg.removeAttr(attributeName);
      }
    }

    return svg;
 * @property {boolean} [allowDeprecatedAttributes=true] - Whether deprecated SVG element attributes should be retained
 * in the SVG during conversion.
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewBox="0 0 1000 1000">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" style="enable-background: new 0 0 100 99.864" xml:space="preserve">
	 width="100px" height="100px" viewBox="206 206 100 100" style="enable-background: new 206 206 100 100" xml:space="preserve">
     width="148px" height="35px" viewBox="0.3 0 148 35" style="enable-background: new 0.3 0 148 35" xml:space="preserve">
	 width="505px" height="505px" viewBox="0 0 505 505" style="enable-background: new 0 0 505 505" xml:space="preserve">
`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `quality`                   | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.