From 7e6031ac7427cf82cf312cb4a25040f2e6efe7a5 Mon Sep 17 00:00:00 2001 From: Alasdair Date: Sun, 29 May 2022 16:37:58 +0100 Subject: [PATCH] Strip onload attribute from SVG input In order to prevent a remote code injection, the `onload` attribute needs to be removed from the SVG input as Puppeteer/Chromium will execute any code within it which could potentially be malicious. Fixes #81 --- package-lock.json | 2 +- packages/convert-svg-core/package.json | 2 +- packages/convert-svg-core/src/Converter.js | 26 +++++++++--------- .../src/fixtures/input/issue-81.svg | 1 + .../convert-svg-test-helper/src/tests.json | 5 ++++ .../test/fixtures/expected/28.jpeg | Bin 0 -> 6791 bytes .../test/fixtures/expected/35.jpeg | Bin 1121 -> 0 bytes .../test/fixtures/expected/36.jpeg | Bin 2071 -> 1121 bytes .../test/fixtures/expected/37.jpeg | Bin 6264 -> 2071 bytes .../test/fixtures/expected/38.jpeg | Bin 0 -> 6264 bytes .../test/fixtures/expected/28.png | Bin 0 -> 3970 bytes 11 files changed, 21 insertions(+), 15 deletions(-) create mode 100644 packages/convert-svg-test-helper/src/fixtures/input/issue-81.svg create mode 100644 packages/convert-svg-to-jpeg/test/fixtures/expected/28.jpeg delete mode 100644 packages/convert-svg-to-jpeg/test/fixtures/expected/35.jpeg create mode 100644 packages/convert-svg-to-jpeg/test/fixtures/expected/38.jpeg create mode 100644 packages/convert-svg-to-png/test/fixtures/expected/28.png diff --git a/package-lock.json b/package-lock.json index 78f854f..a566005 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "license": "MIT", "dependencies": { "chalk": "^4.1.2", - "cheerio": "^1.0.0-rc.10", + "cheerio": "^1.0.0-rc.11", "commander": "^9.2.0", "file-url": "^3.0.0", "get-stdin": "^8.0.0", diff --git a/packages/convert-svg-core/package.json b/packages/convert-svg-core/package.json index 02ef43b..a5fa8e9 100644 --- a/packages/convert-svg-core/package.json +++ b/packages/convert-svg-core/package.json @@ -36,7 +36,7 @@ }, "dependencies": { "chalk": "^4.1.2", - "cheerio": "^1.0.0-rc.10", + "cheerio": "^1.0.0-rc.11", "commander": "^9.2.0", "file-url": "^3.0.0", "get-stdin": "^8.0.0", diff --git a/packages/convert-svg-core/src/Converter.js b/packages/convert-svg-core/src/Converter.js index 9d43043..12653ba 100644 --- a/packages/convert-svg-core/src/Converter.js +++ b/packages/convert-svg-core/src/Converter.js @@ -47,6 +47,7 @@ const _parseOptions = Symbol('parseOptions'); const _provider = Symbol('provider'); const _roundDimension = Symbol('roundDimension'); const _roundDimensions = Symbol('roundDimensions'); +const _sanitize = Symbol('sanitize'); const _setDimensions = Symbol('setDimensions'); const _tempFile = Symbol('tempFile'); const _validate = Symbol('validate'); @@ -114,9 +115,7 @@ class Converter { options = this[_parseOptions](options); - const output = await this[_convert](input, options); - - return output; + return await this[_convert](input, options); } /** @@ -191,11 +190,13 @@ class Converter { input = Buffer.isBuffer(input) ? input.toString('utf8') : input; const { provider } = this; - const svg = cheerio.default.html(cheerio.load(input, null, false)('svg')); + const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg'))); + + if (!svg) { + throw new Error('SVG element not found in input. Check the SVG input'); + } - let html = ''; - if (svg) { - html += ` + const html = ` @@ -207,9 +208,6 @@ html { background-color: ${provider.getBackgroundColor(options)}; } ${svg} `; - } else { - throw new Error('SVG element not found in input. Check the SVG input'); - } const page = await this[_getPage](html); @@ -226,12 +224,10 @@ html { background-color: ${provider.getBackgroundColor(options)}; } await page.setViewport(dimensions); - const output = await page.screenshot(Object.assign({ + return await page.screenshot(Object.assign({ type: provider.getType(), clip: Object.assign({ x: 0, y: 0 }, dimensions) }, provider.getScreenshotOptions(options))); - - return output; } async [_getDimensions](page, options) { @@ -389,6 +385,10 @@ html { background-color: ${provider.getBackgroundColor(options)}; } }; } + [_sanitize](svg) { + return svg.removeAttr('onload'); + } + async [_setDimensions](page, dimensions) { if (typeof dimensions.width !== 'number' && typeof dimensions.height !== 'number') { return; diff --git a/packages/convert-svg-test-helper/src/fixtures/input/issue-81.svg b/packages/convert-svg-test-helper/src/fixtures/input/issue-81.svg new file mode 100644 index 0000000..2f4ea24 --- /dev/null +++ b/packages/convert-svg-test-helper/src/fixtures/input/issue-81.svg @@ -0,0 +1 @@ + diff --git a/packages/convert-svg-test-helper/src/tests.json b/packages/convert-svg-test-helper/src/tests.json index 94a1704..ff5bb82 100644 --- a/packages/convert-svg-test-helper/src/tests.json +++ b/packages/convert-svg-test-helper/src/tests.json @@ -163,6 +163,11 @@ "file": "cve-2021-23631.svg", "message": "should only read SVG element" }, + { + "name": "when SVG has onload attribute", + "file": "issue-81.svg", + "message": "should strip onload attribute" + }, { "name": "when setting both baseFile and baseUrl options", "file": "external-file.svg", diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/28.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/28.jpeg new file mode 100644 index 0000000000000000000000000000000000000000..cac2f014a9ad0d62ab971fbdbe623fca863136e3 GIT binary patch literal 6791 zcmeH`y-UMD7{;G#I%uibV1*7Hf;eQeBUFv=bn4->z9l5V7!3E1R$uudUb{3 zy1uoNSdPY*7Fr#y04UsHpj57#iC9ESrZzO`*^xGCRa^I{Y2L4UIXiGS(WCz_YcQLu z8I<%+Pu--&X|q|<{z6;tN}XxzL#fTRgibjP(xF0!&UEOVdbLhD*D~Lzno>WLo+}l% z9{_=- ztNqkdyQ`1C6#Wp$;f-RKyrus!&v6U179!ckR=+Y7g0dpXlNfC(@GCcp%k025#WOn?b60Vco%m;e)C0!)AjFaahY2?*=) E8}j#Hl>h($ literal 0 HcmV?d00001 diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/35.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/35.jpeg deleted file mode 100644 index 82d4cb31788abd377a281e12842ad835bc6b20eb..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1121 zcmex=dDF&IcpE-rwvvCu$szg+{F&cJY47mGY0A>d!iC?v=ksAd6>t&xtzPC{armlTu$)tmsSPcA3|vF`xcHn};aAiF>S z*>X8BZ zGam@k8FCm>859^i8S)sC8T5cGBL)KoLk6?|w;7xn{!iU#{UBhf*cGf3@OZv zN(@YbjLd?J|Bo<;1Jf=jSt9`^W{`xM08p5biH(tk879ZbBp4{9Xy`a`VWCmu#t%w~ z4}t2$F!Td;fy4#T&1C>uc#DCDnGt9^vmk>#!$oo1Jv-;VeadCMcJCe50FX5yr_R5B zx@6PFvRKOnH;Q7@7Ab3=yUw_jJ!SjiJ(jsY9F=wy-M(W1#4KG8Pv;kau#k4U?%u;~ zZ#WrUA5WX$(7<cQy>#|@9Vgzcv(KyTxcB+A zK*zO$bJHrzyYeMkLQ_kBcxb=^21vhau%2@1&u8y!)1Eb#SMdQ&1A#q-*XO?c=@@ZV hVWB|L$*KlrofHSH1`P)04U9{U`G0jd#lZakCIEL}T*d$Z diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/36.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/36.jpeg index 85ba906f67f72e3d9880ec47e25e9baa903b89ce..82d4cb31788abd377a281e12842ad835bc6b20eb 100644 GIT binary patch delta 554 zcmbO(@Q`DJGgJM4O2KUgXGZePfZ2b5L6CzXg&~ERQHg;`kdaxC@&6G9aRx>pU_b^; z%peIh0iZA=6B{E7Gfa|^Nia}I(a>??!a}3QjUSW}9|F~hVdw|y0*MR4%&mv%X8_uG zi-Cuk5okTLAcH-_MRD6bJLkTA%4NNF?;X|vkh+jl=ifhFvT0*ktmT3mMX_m%l(o-Y zXI#pjvVHL$%iJH1N;`^f-?0ExoMTXerafyeui^um1_FBuuPe=c`O`7ttinQpqLWn($~q|yS`8Wu S%o`Y&9P|I`aEgKX|4jf27Zhax delta 1511 zcmb7-c{tPw7{`CVnGxgK`3=To92pv<2rG9v#yWE@T1V7i5O$`K)jGyek{mH1Et@1V z6-MqmM;eMSY8f>$RJ26ev1v1Fx1MKr|J?WaKF|BS&-e5FzAwazP<1viI!Z!PT2dS( zEhUYHP%>Ce1uO=G)l=K8q-knkVQykzY-DNg?_x>xu{APwi*ok~JWdWHA3RJwO$mU7?)f+7UaPCKC{k1Udl)#uFP`UZu&GX= zipV=2N@9tj&%B1{ZLEb!Lz+FEHez1L?A>>Mch77_hB_V(=tkzPmE7O>TF~$!jtCk> zP5StXHtc*vw8^3=)vERDY_gNCcl2EjU>VpQl~=A?T~=DE^piDYaF_Vil}QitN^-XN zGYkeIv}xYIteA$MZ1x_cmZjII3~SSJ`X0uM>(IPdm+95fr=)MSayZ8GZ0+2;W`)e5 z-ZwWKvr{mWa$WVa?}kiI6ZY}zjlM!xbV6O5xdUVl^OfB2j`8_4Ta(vkH#kY!2P@uN ze_T2wchw^|*o+tva51dP0`(dFIU_L9Ztm`qUAkr-I1XB_#7DqMq;ye%>5d_j8m#Lf0D)&wSkD09O4F6sIvGPdLOWD8{@!3A=FA zdGlpcO(9{z0@&FaGh5Ag+O?u0LE!Io$P(E zKp_~}l_-9%Cfa(+v3AUv)@Y#>roP|2y(JR*bn%Wz!m4`#ehTeMN_#43DJ#UC*(;@= z&$h%}Xi4J_vZ>6zk2VxcL@fDs1PH%Z^MSc`qKBKxYI)X=$5VRhk>LnMr~_4(0qbYI zQ83L6wWTu3ZiWG!eax*t=2$g}{$Dq0pji%(8e~9@*38M)jVq zb;J{aQ^~oQW#d)EY`km{|3EkArVuFYHgqjl$xf(?t6iid8Jzg!nEQdd9;ndvQ7KY7 zmD!Yjq;#OBxZBX9Ja?#Q+`_4TqPg3}4}Mn83t`Ku}xdFdvK zeFGI|UjPvFUqy{S?yA%mtcr?V_rQ;--ijJ&=8>1?v_>8K`2D9BthGsQQ>0EeYz`e~ zX4Jp_K%hLw+??K%DPH6`NhIZUDd4{6@YE;fNQC&5RK=ZALVn|coB{dg`0&ExA*y|Gqu@MD>%D)g1A8j3JvJob zso$aw6ytSK-}~J(ZZIWq4wBXIM^QEzE^b_ZCFjLt%E)kunDWAqvgU=V>}I7$)Y)D< z0V9@?ED_Cf9I9?o*MSSlRab5HI=K`yx;L4$$(WykH|k9f-aXgqN+J5+&TfqkVKjw6 Ka^hEoQ-1=ih>Xkt diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/37.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/37.jpeg index e81d08df57450525c4347844f750918eb27419c3..85ba906f67f72e3d9880ec47e25e9baa903b89ce 100644 GIT binary patch delta 1511 zcmb7-c{tPw7{`CVnUUMh&oL%r$dDsNSQ%G2#yWE@T1V7i5Y{xZ$}x_Tv`#kUSKHtyx`@Y{>f~>cNQIV2TGEx#q z8EF|=2q}lwRzjmtXan_~SZy;SOAAvYyor@VfU6b3*Ukj*9_`^9bd(fM+JBIIGBzY3 zAe2ND@&H>9l9fd(p!JoM^ocfj8{+>M>K9hn13+Rx2oM4XaR3Yg;Seb7126yxz~CSV z{4*k=AYvN~zGa#q0T2$~x#SeyyZ_*>Dhs5ZUt7AOHpf5&!-P!XWroqX$CHS{^5y0;J$uc?b>x2Y@$K ziMZU6f`>#U!+^O|*lgY9>9cK;4roly%61`eUkJDruGi`7EsE5ZzYhn;=St`K8yvE8 zn6mh7PpnvS*i-L8Y8!K5!kFSfr3_mXGkW)&+u1Xdm8F5h0s2t|Yi0K~z7;e+PauFM z(G$LYqK(@h5^QrQ*gEw-y-iNawGQ^BK&FxXVMUet)n)8bwZFVEjkh#MuTFVTP?q<3 zZkk3zgf-6xRFqP16D>XiS**9P-xa~VeT~Dbc|E`)nLQkq0SG*jr z$g!rXh4Zh#5}=trf+X)4Qb& z3prMp^Q{?k0~|7g{n0iS6&X*u6$!%c)_!2D9qZwxGh3hb;c&4%4dM|9WvByLp9Sk< zzE(2J4znZEDsF@WoovSEKd5iL!qy@Z9ZuZKYRo~BVuZk{8&FtDE^1jKp@8INd!4?k zYaQ`e;9Pb#ZW+Idm`Ri`ncLURy&(k3yN%r{RdbW-6Y3UYQ;d#%a?1a}TMtrd`-qK_ zNoO=?9xCszE$ue;tjr%Q8MAb57;ouz^@pEP@J872FJ)&ICRZ&aQ!!0ACg8LmQX%bs3y` zH57q)Oboo|H8lB&F&rr|DP48DT(hugUtYiBGh9UR(NHyZ!U#AI(|H%ba^y@Fw8w`= zKJj1FgW|j|82Y@O!VIJZ%|h~80m#@*nyWi60PC`t8aq5xCZ@75sG@zoCbtFqkUZ0i z(?p47rAo%|od)U68hUU+rP`|PZfDn`CXZ&*HaUya@Fs()fjeheZn1=bTe+;5P+D^+ Kq#$ucIQb_aSB(n* delta 5737 zcmbuDbx_n_+s403E=owcH0%=6ETx1fv7~e^4GT+yfRrMul;qO5v~=gvpnwQ2E!`-x zgp?9ufcpA-;*a<5=bAY)XXd`n=e}o7%$)oAweOORY9tuY|ENDJfZG3n_)q>neE>Ze za0Z-7K~R8%9z;qH`tt_h20#D_2?;3(1pHT2SHV|EC_rSCq~w1M($@fhf`kM_LP}2c zZ`0o?894<&38tcFV7$V_%gkn3xxm5-g-fX*aq}?gzl%6Q0Eq0rOw7N*WE7O(e;6cx z<8b=FNkOEfBxGb1r2h*43kp#DCGt|j!AvSfP;C( zpMc&?*%K}T8(o`T!Q021t19@st$4VW6nlUCNyByi5#1K)6eU>8qjkn_H4anNTvCTnB)B* z&=00!E!h)RNC>ywd7rd-4evvzl0ng_Nxps&y>2>(nSwml9wM~AQL)8Md(z=<$l+ph z9_^_P$gRl9@u0aU0d~u>IUy*(_xWmaPQdM+PO+{wlLek4P+hVkk|n|^0#hLsFa4~h zEqu9^oXdqakV1ilKk}O4jv@Qg2^6gaWC)&!g4{!aaYK@^xFPxz0m9 z8GUA)BpN1U6|K-xGgO3%C=01kjaMSqDpE%nDgo8NPY-kqSmXt^2d=_~Wx0jYO1*my zGBUf%?I1G*k8gc`4}*fZ%_uVaZ+KTIQhsGe#MfSul~cA3ciy_`;Pgw!Apr8JdR^y^ zadHCzS12C4XEbLExj(YUYWX-mMTNVF?Ksnt*@4v{0zv}5xE98#_l#EY_d#Ur zsbt-IA7nUUpM`7Gozsy(`T4VUN20;IRKtixx-1ivIj5AH35J*2JnLrQyv8}=5RI&H z&W^db?Qy;^xIX6g2T-gPz&PEMp?0E^6L{LL)pB*vp^vKc$O`1oTz!4yu99J8Yg>Pt z!J_biF<#xA-yX)Cspz^MGCZu;{zh-Bq4R2~Xo7i=KxdAQx!C0I_@Pm_VY#=oWfL4) z8C8cKXR7HyV!jVl;uNtVoyN%Sv=>_tiP=fjp!%;x9`n#>C5jy_Vp`eHYh^mmU9af$ zXVsB_%dzMUtB;7&MuvL692t)j$#2T9-)!%XiYa{AJc&~orhhh-nNjsiquO@6ej7);Dc&j4Ey#6sCs#1Y z>ydOIfEkj~E3#eYORq-^lYzkcSM(CkEi&%8v=i zk3mt8A$rEYgC3p;{g0Fbut5r$T5cv)8eO7+pUfJJ$qbo|*{1m5(5D}Si*EoSfL~2M znUEdWbBN?Enb82-(>~KUk{hJEB$!ITJ#koH?#t&4rM^b(`CH>9LA0A05s2#3JyS>h z9@#*_5mo`grX{=lO#j}~5rIay=vWP-62%dAkr`$|p`&T?{lP`5VU%Hy!YyW1rY-WD ze*l(gL!gfWP|!J=7S8UY{GM(YEl)YDZ;T@&)lFY#*QIiv89U1FjBR7K#LNwEA7_Y0 zyHM9Uw0a1sHaEK5R$}If>}NxGN^JlV0fO(FITpC4+ zta63HYMpob-*3|;aMyjm=;9pyP5TFs472>@J05%ro9UhGmiSdcd2uN4TVSOSCt0}V z7QSitJTcdxyJ)rW!{<}VK}_=e<>NJ4;vaw#gHsj_Z{N5ioP9n$8vO&f_y4}oJeFI% z?2q~bh^T#Ii|TP+{(s(`v9@GHe)Ffj({8=d=nK%SB85+3k8&^Glk+8Xt%MJY&rGJQ z^0jcEq$*Xb+68YIZrzA?R(5$dD;DWw8u9A;(kW&fMvjF9i?bk|Q3q9Qwyr^U?!HJr zUzqk0>xBtx<_~BcgqYsT7eEUx3fB_T!utX$aYF%S{Dx-g=6dSp2({8`os{9~v?`od zv4_BY(o|IrvI^cO)Fwbi9|;NT0O#-D%d7jI6Y1R%_R(P~jqdEEkVjY1-LH0B>!LQF zmtu_BuJoH1ak^#kc{QuU7%i6<1(YDvevie!zxLIRH^!T`H90_kyweASegP#$ORqNwm+K+Z0pagG@F$g&S+2Db|9HU{jb6S z|2OHx6UY+H(@4S^K0G8YXSPnJRQic6rb9G@mXa^RAek@i@uc#r;BjO_`T6?90$X*9 zy=^l3y)fHPpkOKMtKRAXe2!3j!3WoGs5(mn9cB!|FMsMd(1RwPWj|YpI&iTsyku)0 z?}Xj(_$>K-Tv7bkVAq|MzN<=#ZnbcayDw5>uiCfrG5C(nbE!6giiBb7`j-K7m?Hl- zU=@c`6+3N|UFud>zUh6Xf)KWlmDG(IwA)+LREr#SJNd0?ITsE(!7RY<>s*74*2k>E z4RquSza6awtNxkYcjIjGDHMrQd7X>VUHk<-E9)`{y4Jd&;Nb#Qvy*5N0aO`Rzd-6e zODXS7T-b}^`@M-P3F#O7_#aoYFh$jDp|k3SDQQ7ep;Q9Q%Vmxcqf7+ZP`9>wuPt(4 zJuq_XM?!moH=3`+I+v?yzF|k^w>|hVM(8414~J4TTBVI`lrS;f?~*iqb$8D*sod~W zsR^$3!@i`{sj)~bi8pF98@EtsmHS(*J>KqG0QaPvkvs$IvWD}v9y5^hOtAwx^;e&^hO{ZtG zCYy<- zxGH1LUbplLzwnuil(^s?4B9x`qIP0UbZ$A&N{qObv!qCmtXF-@Q&L40y7Y70r zJr=+Ec&Sc&g{PRH(yy?2K3;J%Bh@e(ZiTlR_o`P-4UCG*QMFBQkgVN+a!pIOX!BOsg-`iph9Xmh6)IOACd9sV z3^-mGQf>W^%V{^80>kqK^qdzvJYC9WPJ_HJDIk>>CP|@)$+lvJ zKb&&TnSa!pAx%-svm;UKIEy!_-$7JsGb`F=(PEV6U%%U3S9KHdW64{{Vc_P5D6qPS3l>KCnlDK~V zZ2VU18>gFK{mjHP@bfKSw_U87nPc$_R|!m(Ru#Ey%$ol=L-VgD*E=A#!z5_9dMtzL z9F?mlsl7LJ3$ZUXu_W%+5n72^`~x88!Ov6uFF${ntrcAjh+*)P=E!?DVL6N#mQxIF znojkh^^KjHGp{pY`GrtW;pHq?iU>u$spc(@&) zZ>z3_deWpy@Ei3^Kj%xCG%i-j!C+y1`R`W_gXi&1Q^ zTzy;9Bf<3Q6?yq$F8q(S;sB`(tbhJ5Du{N+W@R8uu*gnxY)Cjjxc|b1T5u%CFHYq0 z#)hx~O-}dBeRI5>dd^kmebbl_{-j7vQK_MQK7SZM*c}<^W9GpI#@x|%8-VJv`0_F} zHTU>yG6_KyQp~32B1MEaYA`}%TwtYSxvXQUsdv2;)|T%+w)1xVn4R!mpAyB_$@|rK zn=fT0&64L1zU;DV8!TQfg}H)G^v(6FM=GkxF3i*Lj zk=w6LM3?uf`wV|`RgZyNl~7jBcM^&>`uiB}+Vf0xzNM%yrLIZy@L%F0ZDf#8=iqb*Eq406;_Tw}s0*`kOF{S)H&HbeajH zWd;CjhenMP003zp4S+UHZm&^#oBS&AS>Eh=!?bo4`!Kq;)Tgw>K$LJ!B}7%0BAe`F zGt5?!C3cX-1VLzGTBF=yBAm#W1eFrOiNZU1scA7BC{gtLKBu-AnRk+f-DSf^6H_N{}*_soR9|Ad1*=JjJ!7!1;o`HLrZ+ML-$ z|4>&agIBmA>435>lp^!1p6wE^7Sr{gul$>wavK!CQkK5QNMGgKmc>2BsLpz7q%u-6}od&dNO$>(_?AuS84|Jkhb_ z-ans6$Pk;%kc$TP<6v)yDN!ti8-C(BFVep6 zKR0FCZn9ulYNsulQX+(ked1u~jntkH*yr!he#0`PoU0Hp1b>u;+VqG)N?6F9Rm@}8 zw~sGx<$mNwUDOV%UdG^wWW;11S?5USG0O$`1qos-X`UGncJUe>w{YYdXR>^dA-~j@ z6!@h)5{Y&vlh|rl>j+FzJJ?Us|GH9ETz%2?#2q7|{B+4*NaDa;%*W72n{6xFT&p9z zjNxo8;Z}{Rm~{^_;?S{@#ubg?{;69+q ztB*l4S$10$^D&>y&E-~yl*g*Kb81T39*M@L>LRz?4#cMH<>MOkk)|$wU-(#f(Ina* zqeT5|5*f$hKfM#=3E=ppl4frzjEa`bO(Q zO6^-ooa2~y+2=HMObTX2&9z(dG`EILZ7}^DjvS?C1Nw3{WvRIAaMK*S*hr5vHipJD z#X|tC8KhIMt@~spsz{TW$WG;(l7kB_$IJm>9urWtmW7`AGk7L&G z>5qQD6fjjW-bdI~5 z5^#6Tg-hJ@SyH!+&~@-evj&wY^PEk_mF|(G*J73zfeHv?CU9wzoe%F`TqpuD7Kc@X z=Xh9%y=x^O`Fp=VraeR~m14^Q4Lz}yVk%8R@@vP;T24Ourq(hDz4M!tk zN|&7ut$nSghOWq%w&mfGbeSE`mwFw60F7}U+`0L~(|z#VL9oJBJO%v&K2E$|qQa5e zrzJfus&?Kefm#!ZXf+PRw--99ds$mj#TyTFp#0h{CO2~Xa5@NTLq;$F#6F=c1VB4K z0E{R~q3l!iekX>eDiI&PRnx{-MXG(fn_($?@dbYYGJg$M$cJYzcvTlPU+@T0J#CqT zB)X-vq-&jYGbp7^jJ+xBRJim@bdIYK|J$0HDtB>Zl5x>}xK3r&uC-W#V-5OrrS+{} z66a5INl+A1dhBye0`La_UvQCLJlTXKK#wxKx};&X&X^h)vx`zP?^81FSx&*0vDR%D zeoJ1SDxOHf3HU_T={i~0m3@1x;TcV>o~}qwkYd+i_{hXK0hz^4RmzuG`*+WC1X4z5 z+w0TF6_>i=0YNn8uQr-pKU(S#QTuLv=hu)9N(of!2EE6pB6+1kN;9(YtnGXAPu<<(-?5A@LT4KTH1y DIA&7x diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/38.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/38.jpeg new file mode 100644 index 0000000000000000000000000000000000000000..e81d08df57450525c4347844f750918eb27419c3 GIT binary patch literal 6264 zcmb_gcTiN#vOi={f<%`LyX3qiB?uChC^;@jTv&2ivH_GNamh$Va*j&|1w?Skk~4}d zf+Q6X11N9(?!EQhS9M>#Ki=!9IrFQY?qBzunK@ObFPARg0oQaiv^4+%0stVuH{kL; zp@6oUnw_Dsfrj=S*k2QbAOJ7K5&+=k9e^^{ROPaSTXFr-{YxAW{=Wah|6#=Qo-O=g z2Y^}8|1kf*sVJPB{SkPh&-fmI!UxAE>x9P)F8{zGf3V{}aN-|~GBsAi+dRW#0hfQn zj{k;(1AGJUHrPM*2w&76yoSe$UY>z}V*Qan8B;oYo0;H8OMGVo`~hP?6HvwD|5y3@ zefpFDz|F4!K$P;g&M^l7I-&spwDPx(=NSOdL;*nil&=HI;jd(f@lQe|5&(`X0e}h) z0Q7GF;EMIX68+ov@4fgR*2;zVVZ*P}2j5%(Prw=A0<-~d00D^Mkt84iKmpmyRX`1Y zJpOO;hvfgpfcL)a2WZIwC%}n_01Ob)5)jc6T)qN0@!Lm8NJ#YOX#Z0vu99CNBqbmw zBO<{YNL>Q}QbIxkLLw51e;DB*F$pO^MovLXM}LKZn~}w`YLST<43$)YXD>jc@J{Ub zTSENrocN1DN=E*Nf)GCqrNzf2AR;0pCMG5NE9zgI04bi3n+!_Mpkf3zcbH?kE}5E{ z1yTKcxdKoU;q#;=q6L(Jx8Bokbu+^0Pp=ll(3Kn4!Jg+gFCVnj+3$b8)?CFt7u7oc zD($dz3u4)>r%Aoh>zjbwP1zGFCO5h^vx>2cH&>PSeqDKQJt@|A;!)#u-cj9F&K0Mi z(-KFK7sZRSNpT!OUev~!Z9NW}BdwXxg3JO?T{^lb{6ak58pHer1N%Bu>BZ*&yaY4t zkMbKH5u=g3&S6&mc6%<9baK>*o=)0`Ad-SdjHb>{^UA@2Gv^#e=>;M!AAero)c~J? z(We`&!zwLTL>+vC2!1e>XvrKigF-lE&-$gzYq{?^mJW$bPw@;0>-Ess&lcu0_u{|< zO$x29+EezoLk^c(@~KaB2waOD9S&N06CgJ&TM~l&eV(o*=lb93?Go*7H(BH=Ca6z# zfHOrnMpR11OFgM=4_j#?;c%u7B$a34jl5>KW61h=5?*fu6 z$6q@3{-BRF8#>Cy$&J`>ALd2BBC*&#qj?*U@8}-0<-_eOf-0tY8bIZlVyT1XP0y};ifdt zx)HdbaRxg?!fTy!V$N^5pDhk;jJsX}3Uz$pjyI$!9cg6w9(QQ9ULCUUrzktJB0w?L zTpzuyXjs+OKG1HkBy?bmQ8(wcgD_?)xNL-sjOcZ|(%WwAx>_cZU>?NRm8)YeI`un# zcnoS-;U#6+3>yM@Se11+aU3|Db=8cuf^^Q;AlnC9W7j1 z`Oj`Ljt7~ zmH@2a2aXE#e>Z+j|4GbVpb6{U#>C+xu47d6c!P}Fk?y{;?m4twaQciOQ7WULr_P{4 zNYmP_C831m&hhEKn&7>;oLNC*Gn`dz$JZNX^f~z(UHX$s>owOM?kx&h=9bqSqjR`0 zwi+=ZPMn%(bti{!WM&nv&W+M-I~wt>JR!)WCsb_B&Dyk2rZY3De`(a%d}#QPjk_V% zCEUZ$adjt;KgjdGR3I=csaI^X!js+rYyFzNBTVjo4E3XZB{vzc)aB+0UOc6#JXB7j90J22pQi zM8IlJ_Dmi0du0OoN16Hfo0n}1GEsdeqkK(Jk?~r3Mbabm5+lTdR7ca~d%$_BVU%I7 z{7ptxhHa7?mjKg@A<$0>$m<-<2<7yXeNQ)xmLnU{H_j#|(oNrB)unKn9X~4Qifw1K zoFDn{B|{|InX=Bl&0SEnrOEl0A|qGi01M1R>Pabg%#j7FzC8id>bZIEBU&skZzgL5 zIoB5)heojivushYT9@*`+YdAeob}(&yV*y6Q(poS4=jKAOaz}mX8Wdk#D7(iogec3 z=36bwmMGeG4cjt&nwV$MQ@mF6?$Zg`Q1ZgX!*y!hB|sLQtt1lGv3Y?#{d96Pb_uu* z{65$GBD;1m5OoO%t9@gM>UCQAZ?-$*?a8o$mXCWUJ$hr&=LB;Kq~1lnN_`j)_UGXB zQXVuWGnuT~$HHxjqD-xNmweN3TOi&^$@$5gXr!ZQ#Eb9CCle47G$>e%3GReAsAjQo z2~xiOEd6Y8##^)xBBWU`sC5uxdZ&O7$-g92hf53V_pizx_BZ1-G*dU%Q#XgHmDT8^ zjMSu6XKR(X^Z62`sZzC{uK3GK} zTPtmp&q(4CkgcP}K>U&fp#8Gb4}^XuNQ{=+i1I8L%)x&6WXktJe|ELStjus$d&Z^{ z&KQci3I$NF(s9S2Wva)K*mX=;NL=n*y>yw>Bb!c<5Na}>2!mvvw1-nlFM=oFjTL7b zlZz}ht#&ra$hSf)KY_yKtgm`&2he$J$vF>Hzp?r>jo>h22zv2T$DWp8@=4B<#i#>k zyP^x0mWeKifcqzj?-L4QUkrBLm}$GKC27`*_Bi_^HTG(JsveRn-+e0C&R3Z*V%_lE zf4&&?id@D1M8#GcVVk<$U0~{~SQx?*vYNVCi*$W$nre}&ZY#GvBkRmY!=DBCeVuQ- ztMxvsXcHOv%x_0)(Q06J_ss;0TncI8bbi-TbT@Bd@9Ks$jHazVD0rk$)$BN$kPlJL zF~FC4$5PU3EBnE-65qbW)r9nOUd)dxS;aLhp>yhnDQQ6zp%i?KE9DLmV+>fCP}lZ5 zFD>$31Q@vvz`?!2n=MyjohsBcU$Mdq+5>)!W4m$IBcY^CR%zp#r3?(d-4doRZtr;{ zRTzFOGs&)dw=W@iVk{g>=!Mu?m$Q5YqtEZnUTvnDe%>T=vf$E`7a8E_ffOBsGVvx0 zW;RlN+!*9AH%GhKbsKE@3?0ZA`Bh1FjX!`>IHjVPty1si;J})?=3Clp*atB}2lu9$ zPfq7Z{0868tuT4REV$&@Ul-__ZPj-#43mTw1ak+;4lWqcOKM?!TnaJ@^D-azVH&~B zcPE?Us*TzET+=K4!e%p4;(~jT#yJ*slj|b$D}h#`xb56!1zLE6>T9mjYKqY1kECDx zXg#gLCUu**sK|;#R<2a)lCe5NAl5CGso<4Vml2tXVLHlmQ@5 zy)WV?rfA+!Y)8^z1CK1)cG0z`(R>s18ZIs0lyC)w4SO|FW8eJDf_CREHE*@A)f<4W z*>%U%vjnxju}82;r00bzjSxF+vGDwal?@@Yia>$Lz9y?;hrPUdv zA3Qj0QHJSQfY;>+;{|%3CYP_+G~eD4LSKtaH3H|?o72GxQ@k!TK7Qr&w8u0Df3fhi zy>E8jNZ#c3zVU5Dk2WjMV}6V|sLV7lly*hh8A&W78zf(7fqK7dr@yU@%OB%}tMDVs zi^zaY}AN**`1C)HdTahwlY*Y{A+Ny@a! zFg~N$^Bh7h%XwubjPiV#$Zug z)I+hW50~r3R=G;BDg*LcXA_k-GExnrp;j2H3C{-A)WE2?TveL{dx^SDFvrwI-~&}J z(dU?s^#@@q71=*6f_|~(pO$24b2p-_yX0F$R4r0BwYe*8!=}A6L*Xex@>Q$%5@KIF z_SY3_nwv5KVHsZOar|wEhLf?B1|ETMHCK-dm@KG5Wflm>ei zwpyZDdfYc5jHYZiY@`=doW{-QOrzx}Nd?I7bxx5JU%Sl}K@Le#`K&@VKzu)m| zZ*@L#x(U`#OiTkm-SlzYMXQ-Plst10&(f+Uk%?JHP0+RcYIad3U^z?zhpETXsm@cl zco5lnfwy7%l9S6~uAQM(;Y*hQe1ZIFD(d3XySX}%HUAhoKPk5SH;O3cB z)O7@3k7g2+8D@bdFFU@Zq<*c07dnzjg%B3Izv+W?I`+r;g?bJXD$pzLaKhb}E3GuW zOIp>N%f4<>jfogYzgJRyg@`kjNjT=nbP%;lo3IXs?n82@LZXZZS)sUC`FUGuvb1YG z(K}H>&jc_&y8C@k$dauy3eG%`%7+dw+tBm`mF(JH3k(wfs!}~la2!P!k9qni2LI=huYr77Db(ws)8Jb&qQJM^b zVEGiY>G?=uLAF{!Vh(b}WZA4QlGAVcNUbg3yzk)d{xLV{wJ|M%sh9Js^)g@1N}40d z8+zVt+dfpXQU-A$IMI8i>e@819#>G(kJfkAJhFD_5^Fe}BV1s;aWmuxLPd7JE)iML zr|v!S%|$&1YE?>Bwa|qv*&OJnyKToc-I>2FSz8v%ZfrV`Xo1-Dr%K1ls>wb7W^Nmr zV>O>3YOZ^xDgdLox3ZR!5?@sh)}47K01ynj-4ZHyA7~C&$m)WmAk$3fEi(Y%Luk|l zzQzK#iv|d`Om3}{d71nw^RS(2(!au5>!h0CySKxQ`2JD5F*I8{f_M~IAX{s%-pu1Z_Ye!*G-1gx2BDW zpmoO-PZZM)gwtkpAzg|E+BXj#-Z2yU{u4^>zMvnQLT8W$FIYOZ)n?DZp+a384PImq zOZk^~BNP~4^nNJyY&G5Z`2yAKnAfQAm8|To)K#7jGT}xK$jUbM5kF`M-h~xPHSCPa zW8-(#AT`}hXF~mqkW;S6Mur%}{$mg!%^EFMdG!v0`D-Ko>kyL!O>`*z>qikZ%pyJP ztbu+%)E8ok6HVcS9{Zi~2W~&ixb^a4Olv6z^5aI?2GyZ11gH3msQ>%VE$Q|fOiXn% z7R@OUf+gN@5aecRZwTbm_b0z08In%bFbIq{%0g{s)F9 zji_G4U~t5^WG)$}NT+ejMd&#pY&>a!5fF0r9GS3i;Fw^r49JjM?oSH*ToDOJx)FZLZZBR!(=io^Z2PRn)o{ z9&zYUPq|fA=HZzwSG$#V7rCJbTg}pA$J#uUX$X?BF;3`=bHbKtYt7G@CW@F|@W7Rx{Z=z~8z}{_8lUpCoVA*3;!ozqx zKc80MPysMxWc#6A%oFY}bD zoD>V~2evY^L4Db~<*C^@VWzpZv61elEObq2^l7PHNpE{T=RwGP zZWXjfJhzD8(vX+){4>P5-TQj<52 z(1&p$yj+hdNVZeZ00#r=$Xo`=$`=4xJWytr-<-#-v+NNpOsr$l@BeKO8!MhF* zk{>6P4K$vm8wIlAy3a7i8Cfw#(loTnf?@*!(KFPHM(OVW5iq+(`ziQ%-uSDWL^)u z?S*Sx>yt*OSvQLu#2(QpZ82HSPMvD>f=_nJHI)K)pgrkqx3|QhZkmf1*)yj}J$D7K zlW(?YP>3+j-_5wvGn({L)bcz~9%jryUY2C*&Ak^F3WJTuq1B+d?iQkN+DJz6N4vuo zmUh*QKdUX9hiq_AQ6z16YZp5@xEm19T+t|`XA8H_m8D{9!cOb5(jc|3)z;D!8&kL5 zJCZ85<@(&9!{@It;hlYEe(z+TeEuLfDV{f+u1}QuRmJ{MrlY-4gj%_$cg}hogYBB2tvO6WAuI(RdpgJ zY`eCdr%%Cz{0awDav>f>+t)X%a<}r-BBN3OXk7wg$^Y>!o1t; z9WlW>8*ru5Ja|T%hfa^dM32GfP8?5~x{w=Bnlm9^u3HKabteiCBsV0?ct#?CFOEX< zE55RdXO14Nb&fh6GjkiSHJM#MTJ989`)-Y~`@oxyxo*VY!Ks7N-YPI%A49G8KA*~M mbDVNVYQ1m_MIQ14rD(EtDd literal 0 HcmV?d00001