T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/svg2png.js:148
- Finding
- Unbounded SVG Processing Enables Resource-Exhaustion Denial of Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/svg2png.js:148` **Vulnerability Type**: Unrestricted resource consumption during SVG rasterization **Risk Level**: Medium ### Vulnerable Code ```javascript sharp(Buffer.from(svgContent), { limit: 0, density: DPI }) ``` The surrounding implementation also processes every matched `foreignObject` and converts attacker-influenced text into font paths before rasterization: ```javascript while ((match = foreignObjectRegex.exec(svgContent)) !== null) { matches.push({ fullMatch: match[0], attrs: match[1], foreignObjectContent: match[2], index: match.index }); } ``` ### Technical Analysis The conversion script accepts an arbitrary SVG file path, reads the entire file into memory, processes all matching `foreignObject` elements, repeatedly measures text, converts text into SVG paths, and finally passes the resulting document to Sharp at 300 DPI. The Sharp constructor is configured with `limit: 0`, disabling its normal input pixel limit. The script does not impose limits on input file size, SVG dimensions, total pixel count, element count, number of `foreignObject` elements, or text length. Consequently, a malicious or excessively complex SVG can force unbounded CPU and memory consumption. This is an availability vulnerability rather than a privilege-escalation issue. Exploitation does not provide shell execution or access to additional system permissions. ### Attack Path 1. An attacker supplies infographic content or an SVG containing extremely large dimensions, substantial text, many `foreignObject` elements, or computationally expensive SVG structures. 2. The SVG is passed to the documented command: `node mindchart/scripts/svg2png.js input.svg output.png`. 3. The script loads the complete document and iterates through all matching text containers. 4. Attacker-controlled text is repeatedly measured and converted into path data, increasing CPU and memory use. 5. Sharp rasteri ...[truncated 702 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `limit: 0` and configure a conservative Sharp input-pixel limit. 2. Validate SVG width, height, view box, and estimated rasterized pixel count before invoking Sharp. 3. Reject files exceeding defined limits for input bytes, element count, `foreignObject` count, and text length. 4. Restrict maximum output dimensions and rendering density. 5. Apply execution timeouts and operating-system or container limits for memory, CPU, process count, and output size. 6. Parse SVG with a hardened parser instead of relying solely on regular expressions for structural processing. 7. Reject malformed SVGs and unsupported resource-intensive features. 8. Run conversion in an isolated, unprivileged sandbox without network access or access to sensitive filesystem paths. 9. Add automated tests using oversized dimensions, deeply nested elements, long text, and large numbers of `foreignObject` elements to verify that processing terminates safely. ]]>