Are svgs sanatize by fabric js are do i need to santized my self

[sohailahmad07]

Hi
i am letting the user upload svg and it can be rendered on canvas does fabric js sanitize svg or should I do it i am not very well versed on how canvas render the SVG so i don't know if the possible security issue there

let result = await loadSVGFromString(svg)
 const svgGroup = util.groupSVGElements(result.objects, result.options)
 // added to canvas

[Danscap]

following. I'd like to know too

[asturur]

this is a good question.
Svg here are parsed as xml document by the DOMParser() native api.
Whatever that Domparser is vulnerable to, will be fabricJS.
After the parsing is complete, fabricJS maps values and properties to fabric object properties, using regexes.
Some of our regexes resulted vulnerable to Dos attacks, that are not a big issue in the browser but could be in node, and all the one detected by codeql have been fixed.
Once the objects are completed, those are rendered with canvas commands.

FabricJS does not have any sanitization for values and properties, it doesn't parse any script tags from the resulting xmlDom, so no svg code should be executed, but if you have particularly nasty svg attacks examples please share.

[sohailahmad07]

Thnx for the quick reply

no I did not suffer an attack I just want to make sure the code instead SVG is executable or not

[asturur]

the code won't be executed because scripts tags are ignored as far as i can tell.