From a880505859db8db556f2f920b89a026a0e3c2dff Mon Sep 17 00:00:00 2001
From: Seth Falco <seth@falco.fun>
Date: Sun, 29 Oct 2023 14:46:55 +0000
Subject: [PATCH] fix(removeScriptElement): remove link anchors with scripts
 (#1807)

---
 README.md                               |  2 +-
 plugins/removeScriptElement.js          | 46 +++++++++++++++++++++++--
 test/plugins/removeScriptElement.02.svg | 16 +++++++++
 test/plugins/removeScriptElement.03.svg | 17 +++++++++
 4 files changed, 77 insertions(+), 4 deletions(-)
 create mode 100644 test/plugins/removeScriptElement.02.svg
 create mode 100644 test/plugins/removeScriptElement.03.svg

diff --git a/README.md b/README.md
index 7536124e4..d6b9a4d8a 100644
--- a/README.md
+++ b/README.md
@@ -199,7 +199,7 @@ const config = await loadConfig(configFile, cwd);
 | [removeNonInheritableGroupAttrs](https://github.com/svg/svgo/blob/main/plugins/removeNonInheritableGroupAttrs.js) | remove non-inheritable group's "presentation" attributes                                                                                                 | Yes     |
 | [removeOffCanvasPaths](https://github.com/svg/svgo/blob/main/plugins/removeOffCanvasPaths.js)                     | removes elements that are drawn outside of the viewbox                                                                                                   |         |
 | [removeRasterImages](https://github.com/svg/svgo/blob/main/plugins/removeRasterImages.js)                         | remove raster images                                                                                                                                     |         |
-| [removeScriptElement](https://github.com/svg/svgo/blob/main/plugins/removeScriptElement.js)                       | remove `<script>` elements                                                                                                                               |         |
+| [removeScriptElement](https://github.com/svg/svgo/blob/main/plugins/removeScriptElement.js)                       | remove scripts                                                                                                                                 |         |
 | [removeStyleElement](https://github.com/svg/svgo/blob/main/plugins/removeStyleElement.js)                         | remove `<style>` elements                                                                                                                                |         |
 | [removeTitle](https://github.com/svg/svgo/blob/main/plugins/removeTitle.js)                                       | remove `<title>`                                                                                                                                         | Yes     |
 | [removeUnknownsAndDefaults](https://github.com/svg/svgo/blob/main/plugins/removeUnknownsAndDefaults.js)           | remove unknown elements content and attributes, remove attributes with default values                                                                    | Yes     |
diff --git a/plugins/removeScriptElement.js b/plugins/removeScriptElement.js
index 0e42de4c5..fdadd004c 100644
--- a/plugins/removeScriptElement.js
+++ b/plugins/removeScriptElement.js
@@ -1,17 +1,24 @@
 'use strict';
 
 const { detachNodeFromParent } = require('../lib/xast.js');
+const { attrsGroups } = require('./_collections.js');
 
 exports.name = 'removeScriptElement';
-exports.description = 'removes <script> elements (disabled by default)';
+exports.description = 'removes scripts (disabled by default)';
+
+/** Union of all event attributes. */
+const eventAttrs = [
+  ...attrsGroups.animationEvent,
+  ...attrsGroups.graphicalEvent,
+  ...attrsGroups.documentEvent,
+];
 
 /**
- * Remove <script>.
+ * Remove scripts.
  *
  * https://www.w3.org/TR/SVG11/script.html
  *
  * @author Patrick Klingemann
- *
  * @type {import('./plugins-types').Plugin<'removeScriptElement'>}
  */
 exports.fn = () => {
@@ -20,6 +27,39 @@ exports.fn = () => {
       enter: (node, parentNode) => {
         if (node.name === 'script') {
           detachNodeFromParent(node, parentNode);
+          return;
+        }
+
+        for (const attr of eventAttrs) {
+          if (node.attributes[attr] != null) {
+            delete node.attributes[attr];
+          }
+        }
+      },
+      exit: (node, parentNode) => {
+        if (node.name !== 'a') {
+          return;
+        }
+
+        for (const attr of ['href', 'xlink:href']) {
+          if (
+            node.attributes[attr] == null ||
+            !node.attributes[attr].trimStart().startsWith('javascript:')
+          ) {
+            continue;
+          }
+
+          detachNodeFromParent(node, parentNode);
+          const index = parentNode.children.indexOf(node);
+          parentNode.children.splice(index, 1, ...node.children);
+
+          // TODO remove legacy parentNode in v4
+          for (const child of node.children) {
+            Object.defineProperty(child, 'parentNode', {
+              writable: true,
+              value: parentNode,
+            });
+          }
         }
       },
     },
diff --git a/test/plugins/removeScriptElement.02.svg b/test/plugins/removeScriptElement.02.svg
new file mode 100644
index 000000000..19fdde05d
--- /dev/null
+++ b/test/plugins/removeScriptElement.02.svg
@@ -0,0 +1,16 @@
+Collapses links to JavaScript functions, and removes event attributes from
+nodes including children of a collapsed links.
+
+===
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
+  <a href="javascript:(() => { alert('uwu') })();">
+    <text y="10" onclick="alert('uwu')">uwu</text>
+  </a>
+</svg>
+
+@@@
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
+    <text y="10">uwu</text>
+</svg>
diff --git a/test/plugins/removeScriptElement.03.svg b/test/plugins/removeScriptElement.03.svg
new file mode 100644
index 000000000..c06145c81
--- /dev/null
+++ b/test/plugins/removeScriptElement.03.svg
@@ -0,0 +1,17 @@
+Does not remove normal links, and does remove event attributes.
+
+===
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
+  <a href="https://yewtu.be/watch?v=dQw4w9WgXcQ">
+    <text y="10" onclick="alert('uwu')">uwu</text>
+  </a>
+</svg>
+
+@@@
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
+    <a href="https://yewtu.be/watch?v=dQw4w9WgXcQ">
+        <text y="10">uwu</text>
+    </a>
+</svg>