XHRHelper - Add check for SVG response

mrsum / webpack-svgstore-plugin

Simple svg-sprite creating with webpack

https://www.npmjs.com/package/webpack-svgstore-plugin

200 stars 92 forks source link

XHRHelper - Add check for SVG response #116

Closed ryan-codingintrigue closed 7 years ago

ryan-codingintrigue commented 7 years ago

Since innerHTML is currently used unsanitized, it is possible to execute arbitrary Javascript from the the response returned from the AJAX request. This might be a trusted URL, but there is no guarantee of it's validity.

Added a check to ensure an <svg> element is returned in the AJAX response to prevent XSS attacks