Commit b472fe2
committed
![google-labs-jules[bot]](https://avatars.githubusercontent.com/in/842251?v=4&size=40){kind=avatar}
feat(security): disable external entity loading in SVG parser
- Initializes `XMLDocument` with `.nodeLoadExternalEntitiesNever` in `SVGParser.swift`.
- Prevents XML External Entity (XXE) attacks when parsing untrusted SVG files.
- Hardens the codebase against local file inclusion and SSRF vulnerabilities via malicious SVGs.
- Verified `XMLDocument` usage across the codebase; `FileWriter.swift` only writes XML and is safe.1 parent 9bf3069 commit b472fe2
1 file changed
Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments