vendor/pimcore/pimcore/bundles/CoreBundle/EventListener/AssetSanitizationListener.php line 41

Open in your IDE?
  1. <?php
  3. /**
  4.  * Pimcore
  5.  *
  6.  * This source file is available under two different licenses:
  7.  * - GNU General Public License version 3 (GPLv3)
  8.  * - Pimcore Commercial License (PCL)
  9.  * Full copyright and license information is available in
  10.  * LICENSE.md which is distributed with this source code.
  11.  *
  12.  *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
  13.  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  14.  */
  16. namespace Pimcore\Bundle\CoreBundle\EventListener;
  18. use enshrined\svgSanitize\Sanitizer;
  19. use Pimcore\Event\AssetEvents;
  20. use Pimcore\Event\Model\ElementEventInterface;
  21. use Pimcore\Model\Asset;
  22. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  23. use Symfony\Component\Mime\MimeTypes;
  25. /**
  26.  * @internal
  27.  */
  28. class AssetSanitizationListener implements EventSubscriberInterface
  29. {
  30.     public static function getSubscribedEvents()
  31.     {
  32.         return [
  33.             AssetEvents::PRE_ADD => 'sanitizeAsset',
  34.             AssetEvents::PRE_UPDATE => 'sanitizeAsset',
  35.         ];
  36.     }
  38.     /**
  39.      * @param ElementEventInterface $e
  40.      */
  41.     public function sanitizeAsset(ElementEventInterface $e)
  42.     {
  43.         $element = $e->getElement();
  45.         if ($element instanceof Asset\Image && $element->getDataChanged()) {
  46.             $assetStream = $element->getStream();
  48.             if (isset($assetStream)) {
  49.                 $streamMetaData = stream_get_meta_data($assetStream);
  50.                 $mime = MimeTypes::getDefault()->guessMimeType($streamMetaData['uri']);
  52.                 if ($mime === 'image/svg+xml') {
  53.                     $sanitizedData = $this->sanitizeSVG(stream_get_contents($assetStream));
  54.                     $element->setData($sanitizedData);
  55.                 }
  56.             }
  57.         }
  58.     }
  60.     /**
  61.      * @param string $fileContent
  62.      *
  63.      * @return string
  64.      *
  65.      * @throws \Exception
  66.      */
  67.     protected function sanitizeSVG(string $fileContent)
  68.     {
  69.         $sanitizer = new Sanitizer();
  70.         $sanitizedFileContent = $sanitizer->sanitize($fileContent);
  72.         if (!$sanitizedFileContent) {
  73.             throw new \Exception('SVG Sanitization failed, probably due badly formatted XML.');
  74.         }
  76.         return $sanitizedFileContent;
  77.     }
  78. }