Skip to content

Commit

Permalink
Moved feDropShadow to the svg filter allowlist
Browse files Browse the repository at this point in the history
The reason it was there was because "If I remember correctly there was some mXSS risk connected to those", however I searched and couldn't find one (and neither could cure53 #573 (comment)) and so I change it back.
  • Loading branch information
SelfMadeSystem authored Apr 26, 2023
1 parent 60202c7 commit d507666
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/tags.js
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,7 @@ export const svgFilters = freeze([
'feDiffuseLighting',
'feDisplacementMap',
'feDistantLight',
'feDropShadow',
'feFlood',
'feFuncA',
'feFuncB',
Expand Down Expand Up @@ -203,7 +204,6 @@ export const svgDisallowed = freeze([
'color-profile',
'cursor',
'discard',
'fedropshadow',
'font-face',
'font-face-format',
'font-face-name',
Expand Down

0 comments on commit d507666

Please sign in to comment.