Require two hex digits in SVG href percent escapes

Found while testing crates/svg/src/import/files.rs:82 (percent_decoded)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
NetterSilver
2026-10-24 23:32:52 +07:00
committed by bflatastic
co-authored by Claude Haiku 5.5
parent bd96665f44
commit a579ca7073
+12 -1
View File
@@ -79,7 +79,11 @@ fn percent_decoded(s: &str) -> String {
let mut out = Vec::with_capacity(s.len());
let mut rest = s.as_bytes();
while let Some((&b, tail)) = rest.split_first() {
let hex = tail.get(..2).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok());
let hex = tail
.get(..2)
.filter(|h| h.iter().all(u8::is_ascii_hexdigit))
.and_then(|h| std::str::from_utf8(h).ok())
.and_then(|h| u8::from_str_radix(h, 16).ok());
match hex {
Some(v) if b == b'%' => {
out.push(v);
@@ -304,6 +308,13 @@ fn leave_out(why: &AtomicBool, noted: bool) -> Option<ImageKind> {
mod tests {
use super::*;
#[test]
fn percent_decoding_needs_two_hex_digits() {
assert_eq!(percent_decoded("a%41b"), "aAb");
assert_eq!(percent_decoded("a%+1b"), "a%+1b");
assert_eq!(percent_decoded("a%-1b"), "a%-1b");
}
#[test]
fn hrefs_resolve_against_the_folder() {
let sep = std::path::MAIN_SEPARATOR;