10up / safe-svg

Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
https://wordpress.org/plugins/safe-svg/
GNU General Public License v2.0
263 stars 31 forks source link

SVG dimensions broken after 2.2.3 #205

Closed R33D3M33R closed 1 week ago

R33D3M33R commented 2 months ago

Describe the bug

Dear developers,

after the 2.2.3 version, the dimensions of images are broken. The plugin doesn't seem to detect svg width, height, viewbox dimensions properly anymore, and instead pulls values from the actual drawing (path). This breaks layouts, because for example width and height for a svg image set that was dimensioned using padding are now wrong.

Please look into this as this might affect a lot of people.

Best regards, Andrej

Steps to Reproduce

Example: SVG with gets detected as "Dimensions: 46 by 50 pixels", because that is the size of the path inside it. See example for more info:

broken-icon

Screenshots, screen recording, code snippet

No response

Environment information

No response

WordPress information

No response

Code of Conduct

TylerB24890 commented 2 weeks ago

I've tested this on a local environment and have not been able to reproduce. The supplied SVG file in the issue description is protected and cannot be downloaded, but I've tried against 5 different SVGs from different sources with no luck. width and height attributes are extracted from the viewBox attribute and are correct as far as I can see.

If there is an SVG that should be tested specifically, please provide it for reference.

R33D3M33R commented 1 week ago

Hello,

I have tested this on a brand new site and behavior was indeed correct. So I analyzed the problematic sites and discovered: 2.2.2 probably reads info directly from the file (because the dimensions are not rounded to whole pixels) 2.2.3+ reads info from metadata which had incorrect dimensions

Since files were uploaded years ago, its impossible to know why the dimensions in database were incorrect. The simplest solution was using wp media regenerate on problematic files and now the newest version works flawlessly.

Best regards, Andrej