Function isSafeSvgBuffer

server/modules/logoUploadSecurity.js:22–52

(buffer)

};

const isSafeSvgBuffer = (buffer) => {
  if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
    return false;
  }

  const content = buffer.toString("utf8").replace(/^\uFEFF/, "").trim();
  if (!content) return false;

  const hasSvgRoot = /^(?:<\?xml[\s\S]*?\?>\s*)?<svg[\s>][\s\S]*$/i.test(content);
  if (!hasSvgRoot) {
    return false;
  }

  const hasClosingSvg = /<\/svg>\s*$/i.test(content);
  const hasSelfClosingSvg = /<svg[^>]*\/>\s*$/i.test(content);
  if (!hasClosingSvg && !hasSelfClosingSvg) {
    return false;
  }

  const unsafePatterns = [
    /<script[\s>]/i,
    /\son[a-z]+\s*=/i,
    /\b(?:href|xlink:href)\s*=\s*["']?\s*javascript:/i,
    /<foreignobject[\s>]/i,
    /<iframe[\s>]/i,
    /<object[\s>]/i,
    /<embed[\s>]/i,
  ];

  return !unsafePatterns.some((pattern) => pattern.test(content));
};

const getImageTypeFromBuffer = (buffer) => {
  if (!Buffer.isBuffer(buffer) || buffer.length < 12) {