fix(preview): properly handle encoded content

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Author: susnux

lib/private/Preview/SVG.php

@@ -30,12 +30,12 @@ public function getMimeType(): string {
 	public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
 		try {
 			$content = stream_get_contents($file->fopen('r'));
+			$content = ltrim($content);
 			if (substr($content, 0, 5) !== '<?xml') {
 				$content = '<?xml version="1.0" encoding="UTF-8" standalone="no"?>' . $content;
 			}
 
-			// Do not parse SVG files with references
-			if (preg_match('/["\s](xlink:)?href\s*=/i', $content)) {
+			if (!$this->canBeProcessed($content)) {
 				return null;
 			}
 
@@ -72,4 +72,26 @@ public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
 		}
 		return null;
 	}
+
+	/**
+	 * Check if the file can be processed by this provider,
+	 * meaning the SVG is safe to be processed and does not contain any external references.
+	 */
+	protected function canBeProcessed(string $content): bool {
+		// check for allowed encodings and convert if necessary
+		$encoding = mb_detect_encoding($content, ['UTF-8', 'ISO-2022-JP', 'ISO-8859-1'], true);
+		if ($encoding === false) {
+			return false;
+		} elseif ($encoding !== 'UTF-8') {
+			$content = mb_convert_encoding($content, 'UTF-8', $encoding);
+		}
+
+		// Strip all non-printable/control characters except newlines/tabs
+		$content = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $content);
+		// check for any potential external reference (include custom namespace prefix)
+		if (preg_match('/["\s\']([a-z_][a-z0-9_.]*:)?href\s*=/i', $content)) {
+			return false;
+		}
+		return true;
+	}
 }

tests/lib/Preview/SVGTest.php

@@ -61,4 +61,38 @@ public function testGetThumbnailSVGHref(string $content): void {
 
 		self::assertNull($this->provider->getThumbnail($file, 512, 512));
 	}
+
+	#[\PHPUnit\Framework\Attributes\RequiresPhpExtension('imagick')]
+	public function testGetThumbnailSvgHrefNamespace(): void {
+		$handle = fopen('php://temp', 'w+');
+		fwrite($handle, '<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" xmlns:foobar="http://www.w3.org/1999/xlink">
+  <image x="0" y="0" foobar:href="fxlogo.png" height="100" width="100" />
+</svg>');
+		rewind($handle);
+
+		$file = $this->createMock(File::class);
+		$file->method('fopen')
+			->willReturn($handle);
+
+		self::assertNull($this->provider->getThumbnail($file, 512, 512));
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider('dataGetThumbnailSvgEncoded')]
+	#[\PHPUnit\Framework\Attributes\RequiresPhpExtension('imagick')]
+	public function testGetThumbnailSvgEncoded(string $content): void {
+		$handle = fopen('php://temp', 'w+');
+		fwrite($handle, $content);
+		rewind($handle);
+
+		$file = $this->createMock(File::class);
+		$file->method('fopen')
+			->willReturn($handle);
+		self::assertNull($this->provider->getThumbnail($file, 512, 512));
+	}
+
+	public static function dataGetThumbnailSvgEncoded(): array {
+		return [
+			'iso-2022-jp' => ["<?xml version=\"1.0\" encoding=\"ISO-2022-JP\"?>\n<svg width=\"700\" height=\"700\" xmlns=\"http://www.w3.org/2000/svg\">\n<i\x1b(Bmage width=\"700\" height=\"700\" h\x1b(Bref=\"text:/proc/cpuinfo\" />\n</svg>"],
+		];
+	}
 }