Context
- uqr#10 — Escape color attributes in renderSVG to prevent SVG/XML injection (1 comment)
- uqr#9 — Escape SVG colour attributes to prevent XML injection (0 comments)
- bwip-js#327 — Harmonize color regex & ignore SVG default black (6 comments)
- bwip-js#329 — backgroundcolor with # doesn't work or throw error (1 comment)
Description
User-supplied color strings and other options are interpolated directly into SVG markup without sanitization. A malicious or malformed color value like red" onload="alert(1) could inject arbitrary SVG/XML attributes or content.
Current Status in etiket
The barcode SVG renderer has escapeXml() for text content, but color/fill values are inserted directly:
parts.push(`<rect ... fill="${color}"/>`);The QR renderer similarly interpolates color values without escaping.
Proposed Solution
- Add input validation for color values — accept only valid CSS color formats (hex, rgb, hsl, named colors)
- Escape all attribute values that come from user input using XML attribute escaping
- Apply this consistently across all renderers (barcode, QR, matrix)
- Add a shared
escapeAttr() utility that handles ", ', <, >, &
- Add tests with adversarial inputs
Context
Description
User-supplied color strings and other options are interpolated directly into SVG markup without sanitization. A malicious or malformed color value like
red" onload="alert(1)could inject arbitrary SVG/XML attributes or content.Current Status in etiket
The barcode SVG renderer has
escapeXml()for text content, but color/fill values are inserted directly:The QR renderer similarly interpolates color values without escaping.
Proposed Solution
escapeAttr()utility that handles",',<,>,&