From 8501a65566da1202a7d1c72613a98fc2ea05ce09 Mon Sep 17 00:00:00 2001
From: Laurenz Stampfl <47084093+LaurenzV@users.noreply.github.com>
Date: Tue, 10 Sep 2024 19:18:40 +0200
Subject: [PATCH] Add warning when SVG with foreign object is included (#4932)

Co-authored-by: Laurenz <laurmaedje@gmail.com>
---
 crates/typst/src/loading/mod.rs         |  7 +++++++
 crates/typst/src/visualize/image/mod.rs | 18 +++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/crates/typst/src/loading/mod.rs b/crates/typst/src/loading/mod.rs
index dcfafb9e9..a02fb9a9d 100644
--- a/crates/typst/src/loading/mod.rs
+++ b/crates/typst/src/loading/mod.rs
@@ -60,6 +60,13 @@ impl Readable {
             Readable::Str(v) => v.as_bytes(),
         }
     }
+
+    pub(crate) fn as_str(&self) -> Option<&str> {
+        match self {
+            Readable::Str(v) => Some(v.as_str()),
+            Readable::Bytes(v) => std::str::from_utf8(v).ok(),
+        }
+    }
 }
 
 cast! {
diff --git a/crates/typst/src/visualize/image/mod.rs b/crates/typst/src/visualize/image/mod.rs
index 5d952b1a3..b11cf5871 100644
--- a/crates/typst/src/visualize/image/mod.rs
+++ b/crates/typst/src/visualize/image/mod.rs
@@ -13,7 +13,7 @@ use std::sync::Arc;
 use comemo::Tracked;
 use ecow::EcoString;
 
-use crate::diag::{bail, At, SourceResult, StrResult};
+use crate::diag::{bail, warning, At, SourceResult, StrResult};
 use crate::engine::Engine;
 use crate::foundations::{
     cast, elem, func, scope, Bytes, Cast, Content, NativeElement, Packed, Show, Smart,
@@ -190,6 +190,22 @@ fn layout_image(
         Smart::Auto => determine_format(elem.path().as_str(), data).at(span)?,
     };
 
+    // Warn the user if the image contains a foreign object. Not perfect
+    // because the svg could also be encoded, but that's an edge case.
+    if format == ImageFormat::Vector(VectorFormat::Svg) {
+        let has_foreign_object =
+            data.as_str().is_some_and(|s| s.contains("<foreignObject"));
+
+        if has_foreign_object {
+            engine.sink.warn(warning!(
+                span,
+                "image contains foreign object";
+                hint: "SVG images with foreign objects might render incorrectly in typst";
+                hint: "see https://github.com/typst/typst/issues/1421 for more information"
+            ));
+        }
+    }
+
     // Construct the image itself.
     let image = Image::with_fonts(
         data.clone().into(),