[6.x] Harden SVG sanitization

src/Assets/Uploader.php

@@ -58,7 +58,7 @@ private function write($sourcePath, $destinationPath)
     {
         $stream = fopen($sourcePath, 'r');
 
-        if (config('statamic.assets.svg_sanitization_on_upload', true) && Str::endsWith($destinationPath, '.svg')) {
+        if (config('statamic.assets.svg_sanitization_on_upload', true) && Str::of($destinationPath)->lower()->endsWith('.svg')) {
             $stream = Svg::sanitize(stream_get_contents($stream));
         }
 

tests/Assets/AssetTest.php

@@ -2089,6 +2089,33 @@ public function it_does_not_sanitizes_svgs_on_upload_when_behaviour_is_disabled(
         $this->assertStringContainsString('</script>', $asset->contents());
     }
 
+    #[Test]
+    public function it_sanitizes_svgs_on_upload_regardless_of_extension_case()
+    {
+        Event::fake();
+
+        // Disable filename lowercasing so the uppercase extension actually
+        // reaches the disk, otherwise it'd be normalized before we could
+        // prove the sanitization check itself is case insensitive.
+        config()->set('statamic.assets.lowercase', false);
+
+        $asset = (new Asset)->container($this->container)->path('path/to/asset.SVG')->syncOriginal();
+
+        Facades\AssetContainer::shouldReceive('findByHandle')->with('test_container')->andReturn($this->container);
+        Storage::disk('test')->assertMissing('path/to/asset.SVG');
+
+        $return = $asset->upload(UploadedFile::fake()->createWithContent('asset.SVG', '<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" width="500" height="500"><script type="text/javascript">alert(`Bad stuff could go in here.`);</script></svg>'));
+
+        $this->assertEquals($asset, $return);
+        Storage::disk('test')->assertExists('path/to/asset.SVG');
+        $this->assertEquals('path/to/asset.SVG', $asset->path());
+
+        // Ensure the inline scripts were stripped out.
+        $this->assertStringNotContainsString('<script', $asset->contents());
+        $this->assertStringNotContainsString('Bad stuff could go in here.', $asset->contents());
+        $this->assertStringNotContainsString('</script>', $asset->contents());
+    }
+
     public static function nonGlideableFileExtensionsProvider()
     {
         return [

tests/Feature/Fieldtypes/FilesTest.php

@@ -125,6 +125,32 @@ public function it_uploads_a_file_to_the_configured_disk_and_path()
         $localDisk->assertMissing('statamic/file-uploads/1671484636/test.txt');
     }
 
+    #[Test]
+    public function it_sanitizes_svgs_on_upload_regardless_of_extension_case()
+    {
+        $disk = Storage::fake('local');
+
+        Date::setTestNow(Date::createFromTimestamp(1671484636, config('app.timezone')));
+
+        $file = UploadedFile::fake()->createWithContent('test.SVG', '<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" width="500" height="500"><script type="text/javascript">alert(`Bad stuff could go in here.`);</script></svg>');
+
+        $this
+            ->actingAs(tap(User::make()->makeSuper())->save())
+            ->post('/cp/fieldtypes/files/upload', ['file' => $file])
+            ->assertOk()
+            ->assertJson([
+                'data' => [
+                    'id' => $path = '1671484636/test.SVG',
+                ],
+            ]);
+
+        $contents = $disk->get('statamic/file-uploads/'.$path);
+
+        $this->assertStringNotContainsString('<script', $contents);
+        $this->assertStringNotContainsString('Bad stuff could go in here.', $contents);
+        $this->assertStringNotContainsString('</script>', $contents);
+    }
+
     #[Test]
     public function it_replaces_dimensions_rule()
     {