mirror of
https://github.com/getpaseo/paseo.git
synced 2026-10-14 13:22:37 +00:00
5123b23f41
* fix(app): stop a string SVG transform from crashing the app
A root <Svg> is a real React Native view, so react-native-svg rewrites a
*string* `transform` into RN style syntax in `extractTransformSvgView`,
using a PEG parser whose grammar only accepts SVG transform functions.
Upstream lets that parser's SyntaxError escape, so any string it does not
understand takes the whole app down during render:
SyntaxError: Expected transform functions but "n" found.
"found": "n", "location": { "start": { "offset": 0 } }
`none` reproduces that message character for character; so does any other
CSS value (`rotate(-90deg)`, `translate(10px, 0)`). Every sibling
extractor in that file already catches the same error and degrades, so
the asymmetry is the bug: a string that is merely ignored on a <Path>
crashes on an <Svg>.
We feed that path untrusted input. The daemon scans a project for
favicon.svg / icon.svg / logo.svg (packages/server/src/utils/project-icon.ts)
and ships it to the client, where ProjectIconImage hands it to SvgCss.
Running the library's own XML parser over `<svg style="transform:none">`
yields exactly `transform: "none"` on the root, which is why the crash
starts once a host connects and the project icons render, with no
terminal involved.
Note this is *not* reachable from an RN-style array transform: the
extractor returns arrays untouched and only parses strings, so
`style={{ transform: [{ rotate: "-90deg" }] }}` (the context window meter
and the checks ring) was never a factor.
Patch the three builds a consumer can resolve - Metro takes the package's
`react-native` field (src/*.ts), Node and Vitest take main/module - and
register react-native-svg with the postinstall patch runner so the patch
actually applies. The new test pins all three.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EDwfsMWoSFfPm2cFXe5noQ
* test(app): cover parsed root SVG transforms
Exercise the dependency patch with root props produced by the library's XML and CSS parsers, including embedded style rules that can arrive through project icons. Keep dependency-patch documentation focused on the reusable install and resolution constraints.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
62 lines
2.8 KiB
Diff
62 lines
2.8 KiB
Diff
diff --git a/node_modules/react-native-svg/lib/commonjs/lib/extract/extractTransform.js b/node_modules/react-native-svg/lib/commonjs/lib/extract/extractTransform.js
|
|
index f22cca3..0a73681 100644
|
|
--- a/node_modules/react-native-svg/lib/commonjs/lib/extract/extractTransform.js
|
|
+++ b/node_modules/react-native-svg/lib/commonjs/lib/extract/extractTransform.js
|
|
@@ -152,7 +152,12 @@ function extractTransform(props) {
|
|
}
|
|
function extractTransformSvgView(props) {
|
|
if (typeof props.transform === 'string') {
|
|
- return (0, _transformToRn.parse)(props.transform);
|
|
+ try {
|
|
+ return (0, _transformToRn.parse)(props.transform);
|
|
+ } catch (e) {
|
|
+ console.error(e);
|
|
+ return undefined;
|
|
+ }
|
|
}
|
|
return props.transform;
|
|
}
|
|
diff --git a/node_modules/react-native-svg/lib/module/lib/extract/extractTransform.js b/node_modules/react-native-svg/lib/module/lib/extract/extractTransform.js
|
|
index c9d3d6a..085586c 100644
|
|
--- a/node_modules/react-native-svg/lib/module/lib/extract/extractTransform.js
|
|
+++ b/node_modules/react-native-svg/lib/module/lib/extract/extractTransform.js
|
|
@@ -142,7 +142,12 @@ export default function extractTransform(props) {
|
|
}
|
|
export function extractTransformSvgView(props) {
|
|
if (typeof props.transform === 'string') {
|
|
- return parseTransformSvgToRnStyle(props.transform);
|
|
+ try {
|
|
+ return parseTransformSvgToRnStyle(props.transform);
|
|
+ } catch (e) {
|
|
+ console.error(e);
|
|
+ return undefined;
|
|
+ }
|
|
}
|
|
return props.transform;
|
|
}
|
|
diff --git a/node_modules/react-native-svg/src/lib/extract/extractTransform.ts b/node_modules/react-native-svg/src/lib/extract/extractTransform.ts
|
|
index 0c854d6..7dc2828 100644
|
|
--- a/node_modules/react-native-svg/src/lib/extract/extractTransform.ts
|
|
+++ b/node_modules/react-native-svg/src/lib/extract/extractTransform.ts
|
|
@@ -216,7 +216,19 @@ export function extractTransformSvgView(
|
|
props: TransformsStyle
|
|
): TransformsStyle['transform'] {
|
|
if (typeof props.transform === 'string') {
|
|
- return parseTransformSvgToRnStyle(props.transform);
|
|
+ // A root <Svg> is a real RN view, so a string transform has to be rewritten into RN's
|
|
+ // style syntax. The grammar behind this parser only accepts SVG transform functions and
|
|
+ // throws on anything else - including ordinary CSS (`none`, `rotate(-90deg)`). Every other
|
|
+ // extractor in this file already swallows that error; this one did not, so one unrecognised
|
|
+ // string escaped as an uncaught SyntaxError during render and took the whole app down.
|
|
+ // Untrusted SVG reaches this path (a repository's own favicon.svg/logo.svg is rendered
|
|
+ // through SvgXml/SvgCss), so degrade to "no transform" like the rest of the library.
|
|
+ try {
|
|
+ return parseTransformSvgToRnStyle(props.transform);
|
|
+ } catch (e) {
|
|
+ console.error(e);
|
|
+ return undefined;
|
|
+ }
|
|
}
|
|
return props.transform as TransformsStyle['transform'];
|
|
}
|