search

airbnb / babel-plugin-inline-react-svg

A babel plugin that optimizes and inlines SVGs for your React Components.
MIT License
474 stars 92 forks source link

Updating to svgo ^1.0.3 and synchronizing promise #35

Open Trainbird opened 6 years ago

Trainbird commented 6 years ago

This is a fully working update to svgo@^1.0.3, closing #34 on the way.

Closes #34. Closes #44. Closes #45.

michaeljonathanblack commented 6 years ago

Why was this never verified or merged?

ljharb commented 6 years ago

@Trainbird can this PR be updated to update svgo alone?

Trainbird commented 5 years ago

Maybe Babel 7 solves the issue ... this PR in its original idea (synchronizing Promises with a 3rd party plugin) is (understandably) not compliant with package policy.

mengqing commented 5 years ago

Any chance that this PR gets merged or simply just update svgo alone?

The severity of the npm audit on js-yaml -> svgo is now updated to "High - Code Injection" from the "Moderate - Denial of Service"

CarlosOlave commented 5 years ago

any updates on this PR?

Screen Shot 2019-09-12 at 10 10 21 AM

ya'll

ljharb commented 5 years ago

@CarlosOlave it actually is zero severity since it’s a false positive for our use of svgo.

darakian commented 4 years ago

Any update on this PR? I'd much rather not bundle known exploits.

ljharb commented 4 years ago

@darakian this is a babel transform, so it shouldn't be bundled in any case, nor is there any known exploit that actually applies to this package.

darakian commented 4 years ago

@ljharb Is there some public analysis that I can read which supports that conclusion?

ljharb commented 4 years ago

The CVE itself. The attack vector here would have to be, you’re transpiling your own malicious svgs. When the solution is “don’t attack yourself”, it shouldn’t take much convincing that there’s no actual vulnerability.

darakian commented 4 years ago

That does assume that all inputs are known to be good though. In my case that's fine, but as a general stance I don't think that's good.

ljharb commented 4 years ago

All inputs to any Babel transform are known to be good, or else it wouldn’t be safe to transform them.

To reiterate, I’d prefer to upgrade, but Babel transforms are sync and the latest version of svgo is async.

mverissimo commented 4 years ago

Any update about this PR?

ljharb commented 4 years ago

There won’t be any updates until https://github.com/svg/svgo/issues/1015 is addressed.