search

jpkleemans / vite-svg-loader

Vite plugin to load SVG files as Vue components
MIT License
585 stars 61 forks source link

Question about security aspect — accessing system files using dynamic paths #80

Closed digitalcortex closed 1 year ago

digitalcortex commented 1 year ago

This module is a life saver! However I'm curious if there is any security concern when using dynamic paths to load svg? How vite-svg-loader is preventing abuser from altering svg paths on the client side and accessing system files?

jpkleemans commented 1 year ago

Hi, thanks for your question. The library doesn't introduce a security concern by using dynamic paths. Client side code can only access files that are publicly available (usually all files in the /dist folder). Only at compile time it has access to "system files". So if you make sure your dist folder doesn't contain any sensitive files, you'll be fine!