- Fix: Avoid cross-frame unsafe instanceof

- npm: Update eslint-config-ash-nazg
SVG-Edit · Nov 28, 2018 · 99ec41a · 99ec41a
1 parent 9f844f6
commit 99ec41a
Show file tree

Hide file tree

Showing 18 changed files with 95 additions and 33 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -2,8 +2,13 @@
 
 # ?
 
+- Fix: Avoid cross-frame unsafe `instanceof`
 - Enhancement: Add svgcanvas distributions
-- Update: Bump StackBlur version
+- Demo: Rename import to match named dist export
+- Linting (ESLint): Prefer `addEventListener`, exponentiation operator,
+    avoiding catastrophic regexes, prefer spread, prefer
+    `startsWith`/`endsWith`, no fn ref in iterator
+- npm: Update devDeps
 
 # 4.0.1
 

diff --git a/dist/dom-polyfill.js b/dist/dom-polyfill.js
@@ -1,6 +1,20 @@
 (function () {
   'use strict';
 
+  function _typeof(obj) {
+    if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") {
+      _typeof = function (obj) {
+        return typeof obj;
+      };
+    } else {
+      _typeof = function (obj) {
+        return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
+      };
+    }
+
+    return _typeof(obj);
+  }
+
   // From https://github.com/inexorabletash/polyfill/blob/master/dom.js
 
   /**
@@ -37,7 +51,8 @@
 
   function convertNodesIntoANode(nodes) {
     nodes = nodes.map(function (node) {
-      return !(node instanceof Node) ? document.createTextNode(node) : node;
+      var isNode = node && _typeof(node) === 'object' && 'nodeType' in node;
+      return isNode ? node : document.createTextNode(node);
     });
 
     if (nodes.length === 1) {

diff --git a/dist/index-es.js b/dist/index-es.js
@@ -2626,7 +2626,6 @@ var getReverseNS = function getReverseNS() {
   }
 })();
 
-/* globals jQuery */
 var $ = jQuery;
 
 var supportsSVG_ = function () {
@@ -2758,9 +2757,14 @@ var supportsNativeSVGTransformLists_ = function () {
   var rxform = rect.transform.baseVal;
   var t1 = svg.createSVGTransform();
   rxform.appendItem(t1);
-  var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+  var r1 = rxform.getItem(0);
+
+  var isSVGTransform = function isSVGTransform(o) {
+    // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+    return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+  };
 
-  return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+  return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
 }(); // Public API
 
 /**

diff --git a/dist/index-es.min.js b/dist/index-es.min.js
diff --git a/dist/index-es.min.js.map b/dist/index-es.min.js.map
diff --git a/dist/index-umd.js b/dist/index-umd.js
@@ -2632,7 +2632,6 @@
     }
   })();
 
-  /* globals jQuery */
   var $ = jQuery;
 
   var supportsSVG_ = function () {
@@ -2764,9 +2763,14 @@
     var rxform = rect.transform.baseVal;
     var t1 = svg.createSVGTransform();
     rxform.appendItem(t1);
-    var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+    var r1 = rxform.getItem(0);
+
+    var isSVGTransform = function isSVGTransform(o) {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+      return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+    };
 
-    return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+    return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
   }(); // Public API
 
   /**

diff --git a/dist/index-umd.min.js b/dist/index-umd.min.js
diff --git a/dist/index-umd.min.js.map b/dist/index-umd.min.js.map
diff --git a/dist/redirect-on-lacking-support.js b/dist/redirect-on-lacking-support.js
@@ -1,6 +1,20 @@
 (function () {
   'use strict';
 
+  function _typeof(obj) {
+    if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") {
+      _typeof = function (obj) {
+        return typeof obj;
+      };
+    } else {
+      _typeof = function (obj) {
+        return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
+      };
+    }
+
+    return _typeof(obj);
+  }
+
   function _classCallCheck(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
       throw new TypeError("Cannot call a class as a function");
@@ -2419,7 +2433,6 @@
 
   };
 
-  /* globals jQuery */
   var $ = jQuery;
 
   var supportsSVG_ = function () {
@@ -2559,9 +2572,14 @@
     var rxform = rect.transform.baseVal;
     var t1 = svg.createSVGTransform();
     rxform.appendItem(t1);
-    var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+    var r1 = rxform.getItem(0);
+
+    var isSVGTransform = function isSVGTransform(o) {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+      return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+    };
 
-    return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+    return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
   }(); // Public API
 
   if (!supportsSvg()) {

diff --git a/dist/svgcanvas-iife.js b/dist/svgcanvas-iife.js
@@ -2838,7 +2838,6 @@ var SvgCanvas = (function () {
     return reverseNS;
   };
 
-  /* globals jQuery */
   var $ = jQuery;
 
   var supportsSVG_ = function () {
@@ -2970,9 +2969,14 @@ var SvgCanvas = (function () {
     var rxform = rect.transform.baseVal;
     var t1 = svg.createSVGTransform();
     rxform.appendItem(t1);
-    var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+    var r1 = rxform.getItem(0);
+
+    var isSVGTransform = function isSVGTransform(o) {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+      return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+    };
 
-    return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+    return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
   }(); // Public API
 
   /**

diff --git a/dist/svgcanvas-iife.min.js b/dist/svgcanvas-iife.min.js
diff --git a/dist/svgcanvas-iife.min.js.map b/dist/svgcanvas-iife.min.js.map
diff --git a/editor/browser.js b/editor/browser.js
@@ -152,8 +152,11 @@ const rxform = rect.transform.baseVal;
 const t1 = svg.createSVGTransform();
 rxform.appendItem(t1);
 const r1 = rxform.getItem(0);
-// Todo: Do frame-independent instance checking
-return r1 instanceof SVGTransform && t1 instanceof SVGTransform &&
+const isSVGTransform = (o) => {
+  // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+  return o && typeof o === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+};
+return isSVGTransform(r1) && isSVGTransform(t1) &&
   r1.type === t1.type && r1.angle === t1.angle &&
   r1.matrix.a === t1.matrix.a &&
   r1.matrix.b === t1.matrix.b &&

diff --git a/editor/external/dom-polyfill/dom-polyfill.js b/editor/external/dom-polyfill/dom-polyfill.js
@@ -34,7 +34,8 @@ function mixin (o, ps) {
  */
 function convertNodesIntoANode (nodes) {
   nodes = nodes.map((node) => {
-    return !(node instanceof Node) ? document.createTextNode(node) : node;
+    const isNode = node && typeof node === 'object' && 'nodeType' in node;
+    return isNode ? node : document.createTextNode(node);
   });
   if (nodes.length === 1) {
     return nodes[0];

diff --git a/editor/xdomain-svgedit-config-iife.js b/editor/xdomain-svgedit-config-iife.js
@@ -2629,7 +2629,6 @@
     }
   })();
 
-  /* globals jQuery */
   var $ = jQuery;
 
   var supportsSVG_ = function () {
@@ -2761,9 +2760,14 @@
     var rxform = rect.transform.baseVal;
     var t1 = svg.createSVGTransform();
     rxform.appendItem(t1);
-    var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+    var r1 = rxform.getItem(0);
+
+    var isSVGTransform = function isSVGTransform(o) {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+      return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+    };
 
-    return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+    return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
   }(); // Public API
 
   /**

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -84,7 +84,7 @@
     "axe-testcafe": "^1.1.0",
     "babel-plugin-transform-object-rest-spread": "^7.0.0-beta.3",
     "eslint": "5.9.0",
-    "eslint-config-ash-nazg": "0.1.1",
+    "eslint-config-ash-nazg": "0.2.0",
     "eslint-config-standard": "12.0.0",
     "eslint-plugin-compat": "2.6.3",
     "eslint-plugin-import": "2.14.0",

diff --git a/svgedit-config-iife.js b/svgedit-config-iife.js
@@ -2629,7 +2629,6 @@
     }
   })();
 
-  /* globals jQuery */
   var $ = jQuery;
 
   var supportsSVG_ = function () {
@@ -2761,9 +2760,14 @@
     var rxform = rect.transform.baseVal;
     var t1 = svg.createSVGTransform();
     rxform.appendItem(t1);
-    var r1 = rxform.getItem(0); // Todo: Do frame-independent instance checking
+    var r1 = rxform.getItem(0);
+
+    var isSVGTransform = function isSVGTransform(o) {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SVGTransform
+      return o && _typeof(o) === 'object' && typeof o.setMatrix === 'function' && 'angle' in o;
+    };
 
-    return r1 instanceof SVGTransform && t1 instanceof SVGTransform && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
+    return isSVGTransform(r1) && isSVGTransform(t1) && r1.type === t1.type && r1.angle === t1.angle && r1.matrix.a === t1.matrix.a && r1.matrix.b === t1.matrix.b && r1.matrix.c === t1.matrix.c && r1.matrix.d === t1.matrix.d && r1.matrix.e === t1.matrix.e && r1.matrix.f === t1.matrix.f;
   }(); // Public API
 
   /**