babel-plugin-inline-react-svg
babel-plugin-inline-react-svg copied to clipboard
airbnb
Updating to svgo ^1.0.3 and synchronizing promise
This is a fully working update to svgo@^1.0.3, closing #34 on the way.
Closes #34. Closes #44. Closes #45.
Maybe Babel 7 solves the issue ... this PR in its original idea (synchronizing Promises with a 3rd party plugin) is (understandably) not compliant with package policy.
Any chance that this PR gets merged or simply just update svgo alone?
The severity of the npm audit on js-yaml -> svgo is now updated to "High - Code Injection" from the "Moderate - Denial of Service"
ya'll
@CarlosOlave it actually is zero severity since it’s a false positive for our use of svgo.
@darakian this is a babel transform, so it shouldn't be bundled in any case, nor is there any known exploit that actually applies to this package.
@ljharb Is there some public analysis that I can read which supports that conclusion?
The CVE itself. The attack vector here would have to be, you’re transpiling your own malicious svgs. When the solution is “don’t attack yourself”, it shouldn’t take much convincing that there’s no actual vulnerability.
That does assume that all inputs are known to be good though. In my case that's fine, but as a general stance I don't think that's good.
All inputs to any Babel transform are known to be good, or else it wouldn’t be safe to transform them.
To reiterate, I’d prefer to upgrade, but Babel transforms are sync and the latest version of svgo is async.
There won’t be any updates until https://github.com/svg/svgo/issues/1015 is addressed.