isaacclad/ladill-merchant
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block SVG uploads for storefront logos/covers/product images.
Deploy Ladill Merchant / deploy (push) Successful in 24s
Details

Browse Source 
SVG can embed JavaScript and would run as stored XSS when served inline on a
public storefront page, and we have no SVG sanitizer. Allow only raster
formats:
- item_images validation: image rule (permits SVG) -> mimes:jpeg,jpg,png,gif,webp
- QrCodeManagerService: reject image/svg+xml / .svg(z) in brand-image and
  item-image storage (defense in depth, since those only checked the image/* prefix)
- file pickers: accept raster mimes only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
isaacclad
2026-06-10 10:42:04 +00:00
co-authored by Claude Opus 4.8
parent 8b68fad82c
commit f48592077f
3 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/views/merchant/storefronts/partials/editor-fields.blade.php
+8 -8
View File
@@ -92,11 +92,11 @@
<div class="grid gap-4 sm:grid-cols-2">
<div>
<label class="block text-xs font-semibold text-slate-600">Logo (optional)</label>
<input type="file" name="menu_logo" accept="image/*" class="mt-1.5 block w-full rounded-xl border border-slate-200 bg-white px-3.5 py-2.5 text-sm">
<input type="file" name="menu_logo" accept="image/png,image/jpeg,image/gif,image/webp" class="mt-1.5 block w-full rounded-xl border border-slate-200 bg-white px-3.5 py-2.5 text-sm">
</div>
<div>
<label class="block text-xs font-semibold text-slate-600">Cover image (optional)</label>
<input type="file" name="menu_cover" accept="image/*" class="mt-1.5 block w-full rounded-xl border border-slate-200 bg-white px-3.5 py-2.5 text-sm">
<input type="file" name="menu_cover" accept="image/png,image/jpeg,image/gif,image/webp" class="mt-1.5 block w-full rounded-xl border border-slate-200 bg-white px-3.5 py-2.5 text-sm">
</div>
</div>
</div>
@@ -116,12 +116,12 @@
<div class="grid gap-3 sm:grid-cols-3">
<div>
<label class="block text-[11px] font-medium text-slate-500">Logo</label>
<input type="file" name="menu_logo" accept="image/*"
<input type="file" name="menu_logo" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-indigo-50 file:px-2 file:py-1 file:text-xs file:font-semibold file:text-indigo-700">
</div>
<div>
<label class="block text-[11px] font-medium text-slate-500">Cover Image</label>
<input type="file" name="menu_cover" accept="image/*"
<input type="file" name="menu_cover" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-indigo-50 file:px-2 file:py-1 file:text-xs file:font-semibold file:text-indigo-700">
<x-qr.cover-image-hint />
</div>
@@ -166,7 +166,7 @@
class="mt-2 w-full rounded-lg border border-slate-200 px-3 py-2 text-sm">
<div class="mt-2">
<label class="block text-[11px] font-medium text-slate-500">Photo (optional)</label>
<input type="file" :name="'item_images[' + sIdx + '][' + iIdx + ']'" accept="image/*"
<input type="file" :name="'item_images[' + sIdx + '][' + iIdx + ']'" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-slate-100 file:px-2 file:py-1 file:text-xs file:font-medium file:text-slate-600">
</div>
</div>
@@ -199,12 +199,12 @@
<div class="grid gap-3 sm:grid-cols-3">
<div>
<label class="block text-[11px] font-medium text-slate-500">Logo</label>
<input type="file" name="menu_logo" accept="image/*"
<input type="file" name="menu_logo" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-indigo-50 file:px-2 file:py-1 file:text-xs file:font-semibold file:text-indigo-700">
</div>
<div>
<label class="block text-[11px] font-medium text-slate-500">Cover Image</label>
<input type="file" name="menu_cover" accept="image/*"
<input type="file" name="menu_cover" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-indigo-50 file:px-2 file:py-1 file:text-xs file:font-semibold file:text-indigo-700">
<x-qr.cover-image-hint />
</div>
@@ -256,7 +256,7 @@
class="mt-2 w-full rounded-lg border border-slate-200 px-3 py-2 text-sm">
<div class="mt-2">
<label class="block text-[11px] font-medium text-slate-500">Product photo (optional)</label>
<input type="file" :name="'item_images[' + sIdx + '][' + iIdx + ']'" accept="image/*"
<input type="file" :name="'item_images[' + sIdx + '][' + iIdx + ']'" accept="image/png,image/jpeg,image/gif,image/webp"
class="mt-1 block w-full text-xs text-slate-600 file:mr-2 file:rounded-lg file:border-0 file:bg-slate-100 file:px-2 file:py-1 file:text-xs file:font-medium file:text-slate-600">
</div>
</div>