Merge pull request #3037 from nextcloud/backport/3025/stable28

[stable28] fix: svg rendering

Author: susnux

js/viewer-init.js

@@ -44,7 +44,7 @@
 * @license MIT, https://github.com/focus-trap/tabbable/blob/master/LICENSE
 */
 
-/*! @license DOMPurify 3.1.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.1.6/LICENSE */
+/*! @license DOMPurify 3.3.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.1/LICENSE */
 
 /*! For license information please see index.js.LICENSE.txt */
 

js/viewer-init.js.LICENSE.txt

@@ -37,7 +37,7 @@
 * @license MIT, https://github.com/focus-trap/tabbable/blob/master/LICENSE
 */
 
-/*! @license DOMPurify 3.1.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.1.6/LICENSE */
+/*! @license DOMPurify 3.3.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.1/LICENSE */
 
 /*! For license information please see index.js.LICENSE.txt */
 

js/viewer-init.js.map

@@ -57,6 +57,7 @@
     "@skjnldsv/vue-plyr": "^7.4.0",
     "camelcase": "^8.0.0",
     "debounce": "^1.2.1",
+    "dompurify": "^3.3.1",
     "filerobot-image-editor": "^4.8.1",
     "nextcloud-server": "^0.15.10",
     "path-parse": "^1.0.7",

js/viewer-main.js

@@ -87,6 +87,7 @@
 
 <script>
 import PlayCircleOutline from 'vue-material-design-icons/PlayCircleOutline.vue'
+import DOMPurify from 'dompurify'
 
 import axios from '@nextcloud/axios'
 import { basename } from '@nextcloud/paths'
@@ -229,7 +230,8 @@ export default {
 		 */
 		async getBase64FromImage() {
 			const file = await axios.get(this.src)
-			return `data:${this.mime};base64,${btoa(file.data)}`
+			const sanitized = DOMPurify.sanitize(file.data)
+			return `data:${this.mime};base64,${btoa(unescape(encodeURIComponent(sanitized)))}`
 		},
 
 		/**