disallow svg data URLs without approval in categorizeCss function

danmarshall · danmarshall · commit bb40e23840f3 · 2025-07-24T13:38:31.000-07:00
diff --git a/packages/markdown/src/plugins/css.ts b/packages/markdown/src/plugins/css.ts
@@ -116,6 +116,8 @@ function categorizeCss(cssContent: string): CategorizedCss {
                         return { flag: 'svgDataUrl', reason: 'SVG data URL with script detected' };
                     }
                     //TODO check for inline handlers
+                    //for now, disallow svg data URLs
+                    return { flag: 'svgDataUrl', reason: 'SVG data URL detected - requires approval' };
                 }
                 // Other data URLs might be safe, but let's flag for review
                 return { flag: 'externalResource', reason: 'Data URL detected' };

Original file line number	Diff line number	Diff line change
`@@ -116,6 +116,8 @@ function categorizeCss(cssContent: string): CategorizedCss {`
`116`	`116`	`return { flag: 'svgDataUrl', reason: 'SVG data URL with script detected' };`
`117`	`117`	`}`
`118`	`118`	`//TODO check for inline handlers`
	`119`	`+ //for now, disallow svg data URLs`
	`120`	`+ return { flag: 'svgDataUrl', reason: 'SVG data URL detected - requires approval' };`
`119`	`121`	`}`
`120`	`122`	`// Other data URLs might be safe, but let's flag for review`
`121`	`123`	`return { flag: 'externalResource', reason: 'Data URL detected' };`