VSinerva/freesewing
1
0
Fork 0
Code Activity

[react]: fix: Escape user-provided text in SVG. Closes #260

Browse source
This commit is contained in:
joostdecock 2025-05-01 16:26:09 +02:00 • committed by Joost De Cock
parent d0cebc8959
commit d267c04286
2 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packages/react/components/Editor/lib/export/index.mjs
View file

@ -3,7 +3,7 @@ import fileSaver from 'file-saver'
import { themePlugin } from '@freesewing/plugin-theme'
import { pluginI18n } from '@freesewing/plugin-i18n'
import { tilerPlugin } from './plugin-tiler.mjs'
import { capitalize, formatMm, get } from '@freesewing/utils'
import { capitalize, escapeSvgText, formatMm, get } from '@freesewing/utils'
import mustache from 'mustache'
import he from 'he'
import yaml from 'js-yaml'
@ -144,8 +144,9 @@ export const handleExport = async ({
// Save the measurement set name to pattern stores
if (settings?.metadata?.setName) {
pattern.store.set('data.setName', settings.metadata.setName)
for (const store of pattern.setStores) store.set('data.setName', settings.metadata.setName)
pattern.store.set('data.setName', escapeSvgText(settings.metadata.setName))
for (const store of pattern.setStores)
store.set('data.setName', escapeSvgText(settings.metadata.setName))
}
// draft and render the pattern