GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

• npm svgo: >= 2.1.0, < 2.8.1 → fixed in 2.8.1 • npm svgo: >= 3.0.0, < 3.3.3 → fixed in 3.3.3 • npm svgo: >= 4.0.0, < 4.0.1 → fixed in 4.0.1

Summary SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with `JavaScript heap out of memory`. Details The upstream XML parser (sax) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the `DOCTYPE`, inserting them into `parser.ENTITIES`, and enabled `unparsedEntities`. This gives us the desired behavior of supporting SVGs with entities declared in the `DOCTYPE`. However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them. Proof of Concept ```js import { optimize } from 'svgo'; /** Presume that this string was obtained in some other way, such as network. */ const original = ` ]> &lol9; `; optimize(original); ``` Impact If SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG = 2.1.0, ]> &lol9; `; + const parser = SAX.parser(); + /** @param {string} doctype */ + parser.ondoctype = (doctype) => { + original = original.replace(doctype, ''); + } + parser.write(original); optimize(original); ``` Resources • Wikipedia: Billion laughs attack