mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-25 02:47:02 -06:00
ef2c6cb30e
usvg unpacks SVGZ with no limit and parses SVGs embedded in `<image>` data URIs with no shared depth or byte budget, and the nesting check ran on the compressed bytes. FigCraft now unpacks SVGZ itself within 64 MiB, checks the real document, and resolves embedded SVGs with its own data resolver: one 32 MiB budget of unpacked bytes and at most 4 levels, an embedded document past a budget is left out. Rasters still resolve; linked files stay unread. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> Co-authored-by: bflatastic <bombayapirat@gmail.com>
22 lines
630 B
TOML
22 lines
630 B
TOML
[package]
|
|
name = "figcraft-svg"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "FigCraft SVG export (shapes, gradients, images, strokes, effects as filters, text as outlines) and import (via usvg)"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
figcraft-geom = { workspace = true }
|
|
figcraft-color = { workspace = true }
|
|
figcraft-doc = { workspace = true }
|
|
figcraft-render = { workspace = true }
|
|
figcraft-text = { workspace = true }
|
|
figcraft-pathops = { workspace = true }
|
|
usvg = { workspace = true }
|
|
base64 = { workspace = true }
|
|
flate2 = { workspace = true }
|
|
thiserror = { workspace = true }
|