WordCamp.org inline SVGs

gistfile1.php

<?php

/*
 * Allow a whitelisted set of inline SVGs via a shortcode.
 *
 * SVGs ARE NOT IMAGES, they're mini XML applications which can run JavaScript and embed arbitrary 
 * resources across domain boundaries. There are a lot of attack vectors, and they're not well 
 * understood yet. A lot of caution needs to be taken when allowing SVGs, so for now we're only 
 * whitelisting a handful of them when needed.
 *
 * Before adding an SVG to this list, make sure you manually review it for `<script>`, `javascript:`,
 * external resources, and anything else out of the ordinary.
 *
 * For more information, see the following:
 *   https://www.owasp.org/images/0/03/Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf
 *   https://core.trac.wordpress.org/ticket/24251
 */

/**
 * Return the inline SVG for the given ID
 *
 * @param array $attributes
 *
 * @return string
 */
function wcorg_shortcode_inline_svg( $attributes ) {
	$attributes = shortcode_atts( array( 'id' => '' ), $attributes );

	switch ( $attributes['id'] ) {
		case 'lancasterpa-2015-logo':
			$svg = '<svg xmlns:osb="http://www.openswatchbook.org/uri/2009/osb" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" id="svg3004" version="1.1" inkscape:version="0.48.5 r10040" width="625" height="625" xml:space="preserve" sodipodi:docname="WordCamp-Lancaster-Logo-2015-grouped.svg"><metadata   id="metadata3010"><rdf:RDF><cc:Work    rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type   rdf:resource="http://purl.org/dc/dcmitype/StillImage" /></cc:Work></rdf:RDF></metadata><defs   id="defs3008"><linearGradient  id="linearGradient5449"  osb:paint="solid"><stop    style="stop-color:#000000;stop-opacity:1;"    offset="0"    id="stop5451" /></linearGradient><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3018"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3020" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3034"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3036" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3046"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3048" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3102"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3104" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3114"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3116" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3130"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3132" /></clipPath><clipPath  clipPathUnits="userSpaceOnUse"  id="clipPath3186"><path    d="M 0,500 500,500 500,0 0,0 0,500 z"    id="path3188" /></clipPath></defs><sodipodi:namedview   pagecolor="#ffffff"   bordercolor="#666666"   borderopacity="1"   objecttolerance="10"   gridtolerance="10"   guidetolerance="10"   inkscape:pageopacity="0"   inkscape:pageshadow="2"   inkscape:window-width="1606"   inkscape:window-height="953"   id="namedview3006"   showgrid="false"   inkscape:zoom="1.0680141"   inkscape:cx="296.18121"   inkscape:cy="273.75619"   inkscape:window-x="65"   inkscape:window-y="0"   inkscape:window-maximized="0"   inkscape:current-layer="g3012"   showguides="true"   inkscape:guide-bbox="true" /><g   id="g3012"   inkscape:groupmode="layer"   inkscape:label="WordCamp-Lancaster-Logo-2015"   transform="matrix(1.25,0,0,-1.25,0,625)"><g  id="g3014"><g    id="g3016"    clip-path="url(#clipPath3018)"><g   id="g3022"   transform="translate(495,250)"><path     d="m 0,0 c 0,-135.31 -109.69,-245 -245,-245 -135.31,0 -245,109.69 -245,245 0,135.31 109.69,245 245,245 C -109.69,245 0,135.31 0,0"     style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3024" /></g><g   id="g3026"   transform="translate(495,250)"><path     d="m 0,0 c 0,-135.31 -109.69,-245 -245,-245 -135.31,0 -245,109.69 -245,245 0,135.31 109.69,245 245,245 C -109.69,245 0,135.31 0,0 z"     style="fill:none;stroke:#016698;stroke-opacity:1;stroke-width:5.939;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:10;stroke-dasharray:none"     id="path3028" /></g></g></g><g  id="g3030"><g    id="g3032"    clip-path="url(#clipPath3034)"><g   id="g3038"   transform="translate(479,250)"><path     d="m 0,0 c 0,-126.473 -102.527,-229 -229,-229 -126.473,0 -229,102.527 -229,229 0,126.473 102.527,229 229,229 C -102.527,229 0,126.473 0,0 z"     style="fill:none;stroke:#ee3c24;stroke-opacity:1;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:10;stroke-dasharray:none"     id="path3040" /></g></g></g><g  id="g3042" class="rotating-cw"><g    id="g3225"><g   id="g3050"   transform="translate(338.62218,432.93246)"><path     d="m 0,0 -5.069,19.698 0.005,0.011 -0.006,-0.004 -0.004,0.012 -0.007,-0.018 -17.402,-10.53 c -5.564,10.859 -22.834,10.253 -22.834,10.253 5.831,-3.316 6.297,-13.657 -2.333,-34.81 -6.728,-16.489 6.543,-26.049 12.724,-29.465 l -59.11,-144.878 6.025,-2.458 59.111,144.881 c 6.799,-1.883 22.975,-4.342 29.705,12.154 8.631,21.153 16.198,28.217 22.684,26.507 0,0 -11.916,12.515 -23.489,8.647"     style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3052"     inkscape:connector-curvature="0" /></g><g   id="g3054"   transform="translate(159.50198,66.030256)"><path     d="m 0,0 5.069,-19.698 -0.005,-0.011 0.006,0.004 0.004,-0.012 0.007,0.018 17.402,10.53 c 5.564,-10.859 22.834,-10.253 22.834,-10.253 -5.831,3.316 -6.297,13.657 2.333,34.81 6.728,16.489 -6.543,26.049 -12.724,29.465 l 59.11,144.878 -6.025,2.458 L 28.9,47.308 C 22.101,49.191 5.925,51.65 -0.805,35.154 -9.436,14.001 -17.003,6.937 -23.489,8.647 -23.489,8.647 -11.573,-3.868 0,0"     style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3056"     inkscape:connector-curvature="0" /></g><g   id="g3058"   transform="translate(65.610976,339.04146)"><path     d="m 0,0 -19.698,-5.069 -0.011,0.005 0.004,-0.006 -0.012,-0.004 0.018,-0.007 10.53,-17.402 c -10.859,-5.564 -10.253,-22.834 -10.253,-22.834 3.316,5.831 13.657,6.297 34.81,-2.333 16.489,-6.728 26.049,6.543 29.465,12.724 l 144.878,-59.11 2.458,6.025 L 47.308,-28.9 C 49.191,-22.101 51.65,-5.925 35.154,0.805 14.001,9.436 6.937,17.003 8.647,23.489 8.647,23.489 -3.868,11.573 0,0"     style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3060"     inkscape:connector-curvature="0" /></g><g   id="g3062"   transform="translate(434.11318,161.52126)"><path     d="M 0,0 19.698,5.069 19.709,5.064 19.705,5.07 19.717,5.074 19.699,5.081 9.169,22.483 C 20.028,28.047 19.422,45.317 19.422,45.317 16.106,39.486 5.765,39.02 -15.388,47.65 -31.877,54.378 -41.437,41.107 -44.853,34.926 l -144.878,59.11 -2.458,-6.025 L -47.308,28.9 c -1.883,-6.799 -4.342,-22.975 12.154,-29.705 21.153,-8.631 28.217,-16.198 26.507,-22.684 0,0 12.515,11.916 8.647,23.489"     style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3064"     inkscape:connector-curvature="0" /></g></g></g><g  id="g3086"  transform="translate(292.6681,350.5667)" /><g  id="g3208" class="rotating"><g    transform="translate(205.1968,350.6196)"    id="g3066"><path   inkscape:connector-curvature="0"   id="path3068"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 43.301,125.49 86.603,0 0,0 z" /></g><g    transform="translate(294.8032,152.5804)"    id="g3070"><path   inkscape:connector-curvature="0"   id="path3072"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 -43.301,-125.49 -86.603,0 0,0 z" /></g><g    transform="translate(150.9804,206.7968)"    id="g3074"><path   inkscape:connector-curvature="0"   id="path3076"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 -125.49,43.301 0,86.603 0,0 z" /></g><g    transform="translate(349.0196,296.4032)"    id="g3078"><path   inkscape:connector-curvature="0"   id="path3080"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 125.49,-43.301 0,-86.603 0,0 z" /></g><g    transform="translate(210.5319,154.2333)"    id="g3082"><path   inkscape:connector-curvature="0"   id="path3084"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 -119.354,-58.116 -61.237,61.237 0,0 z" /></g><path    inkscape:connector-curvature="0"    id="path3088"    style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"    d="M 0,1.6 119.354,59.716 61.237,-59.637 0,1.6 z"    transform="translate(292.6681,350.5667)" /><g    transform="translate(350.5667,208.9319)"    id="g3090"><path   inkscape:connector-curvature="0"   id="path3092"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 58.116,-119.354 -61.237,-61.237 0,0 z" /></g><g    transform="translate(151.0333,291.0681)"    id="g3094"><path   inkscape:connector-curvature="0"   id="path3096"   style="fill:#016698;fill-opacity:1;fill-rule:nonzero;stroke:none"   d="M 0,0 -58.116,119.354 61.237,61.237 0,0 z" /></g></g><g  id="g3098"><g    id="g3100"    clip-path="url(#clipPath3102)"><g   id="g3106"   transform="translate(140.098,250.3757)"><path     d="M 0,0 C 0,-60.659 49.345,-110.003 109.999,-110.003 170.654,-110.003 220,-60.659 220,0 220,60.653 170.654,109.997 109.999,109.997 49.345,109.997 0,60.653 0,0"     style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3108" /></g></g></g><g  id="g3235"><g    transform="matrix(1.0199748,0,0,1.0166457,-5.095592,-4.4340579)"    style="fill:#ee3c24;fill-opacity:1"    id="g3110" class="wp-logo"><g   style="fill:#ee3c24;fill-opacity:1"   clip-path="url(#clipPath3114)"   id="g3112"><g     style="fill:#ee3c24;fill-opacity:1"     transform="translate(334.6863,296.3014)"     id="g3118"><path    inkscape:connector-curvature="0"    id="path3120"    style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"    d="m 0,0 c 0.415,-3.073 0.649,-6.371 0.649,-9.923 0,-9.79 -1.834,-20.799 -7.341,-34.567 l -29.475,-85.224 c 28.691,16.728 47.986,47.81 47.986,83.416 C 11.819,-29.519 7.531,-13.745 0,0 m -82.992,-54.742 -28.96,-84.137 c 8.649,-2.544 17.792,-3.935 27.264,-3.935 11.239,0 22.02,1.94 32.05,5.472 -0.258,0.413 -0.496,0.852 -0.693,1.33 l -29.661,81.27 z m 63.454,13.311 c 0,11.931 -4.285,20.189 -7.956,26.616 -4.892,7.953 -9.479,14.682 -9.479,22.635 0,8.87 6.726,17.128 16.206,17.128 0.428,0 0.834,-0.052 1.249,-0.078 -17.169,15.733 -40.045,25.338 -65.17,25.338 -33.717,0 -63.377,-17.3 -80.634,-43.498 2.266,-0.072 4.401,-0.117 6.211,-0.117 10.092,0 25.722,1.227 25.722,1.227 5.199,0.304 5.814,-7.339 0.617,-7.953 0,0 -5.23,-0.613 -11.044,-0.917 l 35.142,-104.54 21.122,63.343 -15.035,41.197 c -5.199,0.304 -10.122,0.917 -10.122,0.917 -5.202,0.307 -4.593,8.257 0.612,7.953 0,0 15.934,-1.227 25.417,-1.227 10.092,0 25.723,1.227 25.723,1.227 5.203,0.304 5.815,-7.339 0.615,-7.953 0,0 -5.235,-0.613 -11.044,-0.917 l 34.876,-103.743 9.629,32.165 c 4.892,12.541 7.343,22.94 7.343,31.197 m -161.656,-4.867 c 0,-38.201 22.197,-71.213 54.392,-86.857 l -46.036,126.133 c -5.355,-12.002 -8.356,-25.284 -8.356,-39.276" /></g><g     style="fill:#ee3c24;fill-opacity:1"     transform="translate(142.6594,250.0032)"     id="g3122"><path    inkscape:connector-curvature="0"    id="path3124"    style="fill:#ee3c24;fill-opacity:1;fill-rule:nonzero;stroke:none"    d="m 0,0 c 0,59.185 48.153,107.337 107.339,107.337 59.188,0 107.342,-48.152 107.342,-107.337 0,-59.191 -48.154,-107.343 -107.342,-107.343 C 48.153,-107.343 0,-59.191 0,0 m -5.159,0 c 0,-62.037 50.466,-112.503 112.498,-112.503 62.034,0 112.502,50.466 112.502,112.503 0,62.031 -50.468,112.496 -112.502,112.496 C 45.307,112.496 -5.159,62.031 -5.159,0" /></g></g></g></g><g  id="g3126"><g    id="g3128"    clip-path="url(#clipPath3130)"><g   id="g3134"   transform="translate(201.7978,375.1039)"><path     d="M 0,0 C 0,0 1.138,59.231 -24.034,78.346 -24.034,78.346 27.723,72.379 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3136" /></g><g   id="g3138"   transform="translate(171.1742,446.1737)"><path     d="m 0,0 c 0,0 -7.086,-8.278 2.738,-32.592 9.823,-24.313 24.851,-35.692 24.851,-35.692 0,0 2.905,18.624 -6.918,42.938 C 10.848,-1.033 0,0 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3140" /></g><g   id="g3142"   transform="translate(198.5146,373.7774)"><path     d="M 0,0 C 0,0 -41.964,41.816 -37.135,73.052 -37.135,73.052 -70.22,32.807 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3144" /></g><g   id="g3146"   transform="translate(298.2021,124.8961)"><path     d="m 0,0 c 0,0 -1.138,-59.231 24.034,-78.346 0,0 -51.757,5.967 -24.034,78.346"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3148" /></g><g   id="g3150"   transform="translate(328.8258,53.8263)"><path     d="m 0,0 c 0,0 7.086,8.278 -2.738,32.592 -9.823,24.313 -24.851,35.692 -24.851,35.692 0,0 -2.905,-18.624 6.918,-42.938 C -10.848,1.033 0,0 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3152" /></g><g   id="g3154"   transform="translate(301.4854,126.2226)"><path     d="M 0,0 C 0,0 41.964,-41.816 37.135,-73.052 37.135,-73.052 70.22,-32.807 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3156" /></g><g   id="g3158"   transform="translate(124.8961,201.7978)"><path     d="m 0,0 c 0,0 -59.231,1.138 -78.346,-24.034 0,0 5.967,51.757 78.346,24.034"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3160" /></g><g   id="g3162"   transform="translate(53.8263,171.1742)"><path     d="m 0,0 c 0,0 8.278,-7.086 32.592,2.738 24.313,9.823 35.692,24.851 35.692,24.851 0,0 -18.624,2.905 -42.938,-6.918 C 1.033,10.848 0,0 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3164" /></g><g   id="g3166"   transform="translate(126.2226,198.5146)"><path     d="m 0,0 c 0,0 -41.816,-41.964 -73.052,-37.135 0,0 40.245,-33.085 73.052,37.135"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3168" /></g><g   id="g3170"   transform="translate(375.1039,298.2021)"><path     d="M 0,0 C 0,0 59.231,-1.138 78.346,24.034 78.346,24.034 72.379,-27.723 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3172" /></g><g   id="g3174"   transform="translate(446.1737,328.8258)"><path     d="m 0,0 c 0,0 -8.278,7.086 -32.592,-2.738 -24.313,-9.823 -35.692,-24.851 -35.692,-24.851 0,0 18.624,-2.905 42.938,6.918 C -1.033,-10.848 0,0 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3176" /></g><g   id="g3178"   transform="translate(373.7774,301.4854)"><path     d="M 0,0 C 0,0 41.816,41.964 73.052,37.135 73.052,37.135 32.807,70.22 0,0"     style="fill:#f69668;fill-opacity:1;fill-rule:nonzero;stroke:none"     id="path3180" /></g></g></g></g></svg>';
			break;

		default:
			$svg = '';
	}

	return $svg;
}
add_shortcode( 'inline-svg', 'wcorg_shortcode_inline_svg' );