iTwin / itwinjs-core

Monorepo for iTwin.js Library
https://www.itwinjs.org
MIT License
606 stars 210 forks source link

upgrade svgdotjs package #7175

Closed bilalbaig3101 closed 1 day ago

bilalbaig3101 commented 1 week ago

upgraded the svgdotjs package to the latest version. The previous version was found to be dangerously injecting HTML, which raised security concerns under the Trusted Types policy. Upgrading to the latest version addresses this vulnerability and reduces the risk of cross-site scripting (XSS) attacks.

CLAassistant commented 1 week ago

CLA assistant check
All committers have signed the CLA.

pmconne commented 1 week ago

Failing tests:

1) Markup
     SVG Text:
    innerHTML
    + expected - actual
    -test1<tspan dy="10" x="-65.046875">test2</tspan><tspan dy="10" x="0">test3</tspan>
    +test1<tspan dy="10" x="0">test2</tspan><tspan dy="10" x="0">test3</tspan>

    at Context.<anonymous> (D:\vsts_a\4\s\core\markup\src\test\Markup.test.ts:44:12)
    at callFn (@/lib/runnable.js:366:21)
    at Test$4.Runnable$3.run (@/lib/runnable.js:354:5)
    at Runner.runTest (@/lib/runner.js:666:10)
    at http://localhost:3040/@/lib/runner.js:789:12
    at next (@/lib/runner.js:581:14)
    at http://localhost:3040/@/lib/runner.js:591:7
    at next (@/lib/runner.js:474:14)
    at http://localhost:3040/@/lib/runner.js:559:5
    at timeslice (@/browser-entry.js:100:27)
2) Markup
     SVG groups:
   TypeError: Converting circular structure to JSON
  --> starting at object with constructor 'Rect'
  |     property 'node' -> object with constructor 'SVGRectElement'
  --- property 'instance' closes the circle
    at JSON.stringify (<anonymous>)
    at Function.serialize (src/runners/chrome/MochaSerializer.ts:69:17)
    at eval (eval at evaluate (:197:30), <anonymous>:11:120)
    at Array.map (<anonymous>)
    at Runner.eval (eval at evaluate (:197:30), <anonymous>:11:93)
    at Runner.fail (@/lib/runner.js:453:8)
    at http://localhost:3040/@/lib/runner.js:814:18
    at done (@/lib/runnable.js:310:5)
mergify[bot] commented 1 week ago

This pull request is now in conflicts. Could you fix it @bilalbaig3101? 🙏 To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/