[TASK] Use PHP 8.5 development and browser runtimes

.Build/test.docker-compose.yml

@@ -1,7 +1,7 @@
 # With this setup you can Test the Storybook setup integrated with TYPO3, Fluid, EXT:storybook, Storybook and the Storybook Framework package
 services:
   typo3:
-    image: ghcr.io/pluswerk/php-dev:apache-${PHP_IMAGE_VERSION:-8.4}-alpine
+    image: ghcr.io/pluswerk/php-dev:apache-${PHP_IMAGE_VERSION:-8.5}-alpine
     working_dir: ${DOCKER_ROOT_PWD}/Documentation/dummy-project
     volumes:
       - ${DOCKER_ROOT_PWD}:${DOCKER_ROOT_PWD}

.Build/test.sh

@@ -56,7 +56,7 @@ function testFunction {
        ;;
      composerInstall)
        rm -rf dummy-project/vendor/
-       COMPOSE_PROJECT_NAME=testing-storybook docker compose -f test.docker-compose.yml run --rm --remove-orphans typo3 su application -c "rm -f composer.lock && composer req typo3/cms-core:~${TYPO3_VERSION}"
+       COMPOSE_PROJECT_NAME=testing-storybook docker compose -f test.docker-compose.yml run --rm --remove-orphans typo3 su application -c "rm -f composer.lock && composer req typo3/cms-core:~${TYPO3_VERSION} 'enshrined/svg-sanitize:1.0.0 as 0.22.99' --sort-packages --no-interaction -W && bash ../../Tests/typo3-svg-sanitizer.sh"
        chmod 777 $DOCKER_ROOT_PWD/Documentation/dummy-project/public/
        return
        ;;

.ddev/config.yaml

@@ -1,7 +1,7 @@
 name: storybook
 type: typo3
 docroot: public
-php_version: "8.3"
+php_version: "8.5"
 webserver_type: nginx-fpm
 xdebug_enabled: false
 additional_hostnames: []

.github/workflows/tasks.yml

@@ -37,7 +37,9 @@ jobs:
           key: ${{ runner.os }}-${{ matrix.php }}-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: |
             ${{ runner.os }}-${{ matrix.php }}-composer-
-      - run: composer require typo3/minimal="^${{ matrix.typo3 }}" --dev --ignore-platform-req=php+
+      # CI-only alias until TYPO3 accepts the security-fixed svg-sanitize ^1.0.
+      - run: composer require typo3/minimal="^${{ matrix.typo3 }}" "enshrined/svg-sanitize:1.0.0 as 0.22.99" --dev --sort-packages --no-interaction -W
+      - run: bash Tests/typo3-svg-sanitizer.sh
       - run: ./vendor/bin/grumphp run --ansi
       - run: composer test:unit
 

Tests/typo3-svg-sanitizer.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Exercise TYPO3's adapter against the actual security-fixed release, not its CI alias.
+php <<'PHP'
+<?php
+
+require 'vendor/autoload.php';
+
+function check(bool $condition, string $message): void
+{
+    if (!$condition) {
+        throw new RuntimeException($message);
+    }
+}
+
+check(
+    Composer\InstalledVersions::getPrettyVersion('enshrined/svg-sanitize') === '1.0.0',
+    'Expected the actual security-fixed svg-sanitize 1.0.0 release'
+);
+
+$sanitizer = new TYPO3\CMS\Core\Resource\Security\SvgSanitizer();
+$svg = '<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">'
+    . '<rect id="safe" width="10" height="10"/>'
+    . '<image href="https://example.invalid/remote.svg"/></svg>';
+$clean = $sanitizer->sanitizeContent($svg);
+check(str_contains($clean, 'id="safe"'), 'Valid SVG content was removed');
+check(!str_contains($clean, 'onload'), 'Event handler was not removed');
+check(!str_contains($clean, 'example.invalid'), 'Remote reference was not removed');
+
+$entity = '<!DOCTYPE svg [<!ENTITY Tab "#">]>'
+    . '<svg xmlns="http://www.w3.org/2000/svg"><a href="&Tab;javascript:alert(1)"/></svg>';
+check($sanitizer->sanitizeContent($entity) === '', 'DTD entity bypass was not rejected');
+
+$document = new DOMDocument();
+check($document->loadXML($svg), 'Failed to load SVG fixture');
+$node = $sanitizer->sanitizeNode($document->documentElement);
+$cleanNode = $document->saveXML($node);
+check(str_contains($cleanNode, 'id="safe"'), 'sanitizeNode removed valid content');
+check(!str_contains($cleanNode, 'onload'), 'sanitizeNode retained an event handler');
+check(!str_contains($cleanNode, 'example.invalid'), 'sanitizeNode retained a remote reference');
+
+$file = tempnam(sys_get_temp_dir(), 'typo3-svg-');
+check($file !== false, 'Failed to create temporary SVG fixture');
+try {
+    check(file_put_contents($file, $svg) !== false, 'Failed to write SVG fixture');
+    $sanitizer->sanitizeFile($file);
+    check(file_get_contents($file) === $clean, 'sanitizeFile produced unexpected output');
+} finally {
+    unlink($file);
+}
+
+echo "PASS: TYPO3 SVG content, node, file and DTD entity regression checks\n";
+PHP