Socket
Socket
Sign inDemoInstall

is-svg

Package Overview
Dependencies
Maintainers
2
Versions
24
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

is-svg - npm Package Compare versions

Comparing version 4.2.2 to 4.3.0

51

index.js
'use strict';
const htmlCommentRegex = require('html-comment-regex');
const parser = require('fast-xml-parser');
const isBinary = buffer => {
const isBuffer = Buffer.isBuffer(buffer);
const isSvg = input => {
if (input === undefined || input === null) {
return false;
}
for (let i = 0; i < 24; i++) {
const characterCode = isBuffer ? buffer[i] : buffer.charCodeAt(i);
input = input.toString().trim();
if (characterCode === 65533 || characterCode <= 8) {
return true;
}
if (input.length === 0) {
return false;
}
return false;
};
// Has to be `!==` as it can also return an object with error info.
console.log('a', parser.validate(input));
if (parser.validate(input) !== true) {
return false;
}
const cleanEntities = svg => {
const entityRegex = /\s*<!Entity\s+\S*\s*(?:"|')[^"]+(?:"|')\s*>/img;
// Remove entities
return svg.replace(entityRegex, '');
};
let jsonObject;
try {
jsonObject = parser.parse(input);
} catch (_) {
return false;
}
const removeDtdMarkupDeclarations = svg => svg.replace(/\[?(?:\s*<![A-Z]+[^>]*>\s*)*\]?/g, '');
if (!jsonObject) {
return false;
}
const clean = svg => {
svg = cleanEntities(svg);
svg = removeDtdMarkupDeclarations(svg);
return svg;
if (!('svg' in jsonObject)) {
return false;
}
return true;
};
const regex = /^\s*(?:<\?xml[^>]*>\s*)?(?:<!doctype svg[^>]*>\s*)?(?:<svg[^>]*>[^]*<\/svg>|<svg[^/>]*\/\s*>)\s*$/i;
const isSvg = input => Boolean(input) && !isBinary(input) && regex.test(clean(input.toString()).replace(htmlCommentRegex, ''));
module.exports = isSvg;
// TODO: Remove this for the next major release
module.exports.default = isSvg;
{
"name": "is-svg",
"version": "4.2.2",
"version": "4.3.0",
"description": "Check if a string or buffer is SVG",

@@ -40,3 +40,3 @@ "license": "MIT",

"dependencies": {
"html-comment-regex": "^1.1.2"
"fast-xml-parser": "^3.19.0"
},

@@ -43,0 +43,0 @@ "devDependencies": {

@@ -20,10 +20,2 @@ # is-svg

## Edge cases
This module performs a quick-and-dirty check. It's fast, but in certain cases it will give incorrect results.
- Returns `true` for an SVG-like string that isn't well-formed or valid: `<svg><div></svg>`
If you want to make certain that your SVG is *valid*, try parsing it with [libxmljs](https://github.com/polotek/libxmljs).
---

@@ -30,0 +22,0 @@

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc