2createStudio / postcss-sprites

Generate sprites from stylesheets.
MIT License
413 stars 50 forks source link

Hashing SVG sprite IDs #74

Closed niksy closed 7 years ago

niksy commented 7 years ago

Currently, SVG sprite process generates SVG shapes with ID attributes which are full paths to original SVG images. This can potentially have issues regarding special characters or paths which you would like to keep private (e.g. path to file system).

Since ID values are necessary to obtain full path to original SVG file, which is used as key for spritesheet object, maybe those ID values should be base64 encoded for svg-sprite and then base64 decoded when referencing them for spritesheet object?

ID attributes can be removed with SVGO plugins as part of separate process, but that seems like additional unecessary work. I think this should be handled with postcss-sprites.

For example, in core.js

shape: {
    id: {
        generator(name, file) {
            return `id-${new Buffer(file.path).toString('base64')}`;
        }
    }
}

And in factories/vector.js

data.css.shapes.forEach((shape) => {
    spritesheet.coordinates[new Buffer(shape.name.replace(/^id-/, ''), 'base64').toString()] = {
        // ...
    };
});

Also, probably consider using safe-buffer to handle newer versions of Node and potential security issues.