As discussed in #1511684: Offer to co-maintain, I'd like to use the Noun Project API for a new widget.

Comments

sreynen’s picture

sreynen commented
Assigned: Unassigned » sreynen
sreynen’s picture

sreynen commented
Status: Active » Fixed

Committed. I had to make some changes to the validation to get this to work, since the SVG from Noun Project doesn't pass strict validation.

This could use some interface improvement, but it works.

josegaert’s picture

josegaert commented

Dear sreyen,

Thank you for your extension and you interest in this module!
I haven't committed for a while because I'm just experimenting with trying to implement svg-edit as a widget. But I'm almost there.
It will take mo another week I reckon.

josegaert’s picture

josegaert commented
Assigned: sreynen » Unassigned
Category: task » bug
Status: Fixed » Needs work

You put this into svg_field_validate:

if ($instance['widget']['type'] == 'svg_code_widget') {

While it does solve your validation problem by not validating at all it introduces a security risk.
The real solution would is to find out why the validation fails and changing the broken validation code.

sreynen’s picture

sreynen commented

The validation code isn't broken. It's just doing strict XML validation, which is very hard to pass. The Noun Project code fails because the attributes aren't properly namespaced. I don't think we can rely on XML validation for security. A script tag is valid SVG, so XML validation would still allow XSS attacks. We probably need to use filter_xss() for security. But that will need a long list of valid SVG tags, minus script.