From 97365f544b04e24632313101e57026c7e9661d10 Mon Sep 17 00:00:00 2001 From: Kevin Jilissen Date: Fri, 28 Feb 2025 15:55:12 +0000 Subject: [PATCH] Add a basic test for SVG sanitation --- .../Controller/Jury/SubmissionController.php | 1 + .../Controller/Team/SubmissionController.php | 1 + webapp/templates/jury/submission.html.twig | 5 ++ webapp/tests/Unit/Utils/UtilsTest.php | 49 +++++++++++++++++++ 4 files changed, 56 insertions(+) diff --git a/webapp/src/Controller/Jury/SubmissionController.php b/webapp/src/Controller/Jury/SubmissionController.php index 90027eecc0..0927fdce0c 100644 --- a/webapp/src/Controller/Jury/SubmissionController.php +++ b/webapp/src/Controller/Jury/SubmissionController.php @@ -581,6 +581,7 @@ public function viewAction( 'requestedOutputCount' => $requestedOutputCount, 'version_warnings' => [], 'isMultiPassProblem' => $submission->getProblem()->isMultipassProblem(), + 'thumbnailSize' => $this->config->get('thumbnail_size'), ]; if ($selectedJudging === null) { diff --git a/webapp/src/Controller/Team/SubmissionController.php b/webapp/src/Controller/Team/SubmissionController.php index c26cffb046..5300b2273f 100644 --- a/webapp/src/Controller/Team/SubmissionController.php +++ b/webapp/src/Controller/Team/SubmissionController.php @@ -200,6 +200,7 @@ public function viewAction(Request $request, int $submitId): Response 'showSampleOutput' => $showSampleOutput, 'runs' => $runs, 'showTooLateResult' => $showTooLateResult, + 'thumbnailSize' => $this->config->get('thumbnail_size'), ]; if ($actuallyShowCompile) { $data['size'] = 'xl'; diff --git a/webapp/templates/jury/submission.html.twig b/webapp/templates/jury/submission.html.twig index 6d9585e4c1..9a17bc6ff9 100644 --- a/webapp/templates/jury/submission.html.twig +++ b/webapp/templates/jury/submission.html.twig @@ -19,6 +19,11 @@ .judging-table tr.disabled td a { color: silver } + + .image_thumb { + max-width: {{ thumbnailSize }}px; + max-height: {{ thumbnailSize }}px; + } {% endblock %} diff --git a/webapp/tests/Unit/Utils/UtilsTest.php b/webapp/tests/Unit/Utils/UtilsTest.php index 15d60d8efb..f5ff542aa2 100644 --- a/webapp/tests/Unit/Utils/UtilsTest.php +++ b/webapp/tests/Unit/Utils/UtilsTest.php @@ -713,6 +713,55 @@ public function provideTestGetImageSize(): Generator yield [__DIR__ . '/../../../public/images/DOMjudgelogo.svg', 510, 1122]; } + public function testSanitizeSvg(): void + { + // SVG source: https://svg.enshrined.co.uk/ + $dirty = << + + + + + + + + + + + + + + + + + test 1 + test 2 + test 3 + test 4 + + test 5 + test 6 + + + + + + + + shouldn't be here + + + + + EOF; + $clean = Utils::sanitizeSvg($dirty); + self::assertFalse(str_contains($clean, "script")); + self::assertFalse(str_contains($clean, "alert")); + self::assertFalse(str_contains($clean, "shouldn't be here")); + self::assertFalse(str_contains($clean, "example.com")); + self::assertTrue(str_contains($clean, '')); + } + /** * Test that the wrapUnquoted function returns the correct result */