github/svgedit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

- Fix: Avoid cross-frame unsafe instanceof

Browse Source 
- npm: Update eslint-config-ash-nazg
This commit is contained in:
Brett Zamir
2018-11-28 08:56:41 +08:00
parent 9f844f6496
commit 99ec41a3c3
18 changed files with 95 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
editor/browser.js
View File

@@ -152,8 +152,11 @@ const rxform = rect.transform.baseVal;
const t1 = svg.createSVGTransform();
rxform.appendItem(t1);
const r1 = rxform.getItem(0);
// Todo: Do frame-independent instance checking
return r1 instanceof SVGTransform && t1 instanceof SVGTransform &&
const isSVGTransform = (o) => {
// https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
return o && typeof o === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
};
return isSVGTransform(r1) && isSVGTransform(t1) &&
r1.type === t1.type && r1.angle === t1.angle &&
r1.matrix.a === t1.matrix.a &&
r1.matrix.b === t1.matrix.b &&

3
editor/external/dom-polyfill/dom-polyfill.js vendored
View File

@@ -34,7 +34,8 @@ function mixin (o, ps) {
*/
function convertNodesIntoANode (nodes) {
nodes = nodes.map((node) => {
return !(node instanceof Node) ? document.createTextNode(node) : node;
const isNode = node && typeof node === 'object' && 'nodeType' in node;
return isNode ? node : document.createTextNode(node);
});
if (nodes.length === 1) {
return nodes[0];

10
editor/xdomain-svgedit-config-iife.js
View File

@@ -2629,7 +2629,6 @@
}
})();
/* globals jQuery */
var $ = jQuery;
var supportsSVG_ = function () {
@@ -2761,9 +2760,14 @@
var rxform = rect.transform.baseVal;
var t1 = svg.createSVGTransform();
rxform.appendItem(t1);
var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
var r1 = rxform.getItem(0);
return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
var isSVGTransform = function isSVGTransform(o) {
// https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
};
return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
}(); // Public API
/**