Version bumps

Author: cvasseng

CHANGELOG.md

@@ -1,9 +1,18 @@
 # 5.0.0
 
+_Breaking Changes:_
+
+- Removed `xlink:href` from incoming SVGs in preperation for an upcoming puppeteer update that will remove this option.
+- Changed the upload file size limit to 3MB, and exposed settings for configuring it (`SERVER_MAX_UPLOAD_SIZE`/`--maxUploadSize`/`maxUploadSize`). The rational behind this change is that in testing that seems like the most balanced limit along with other default values for pool sizing, timeouts and such to avoid attempting to process requests that would likely end up timing out due to its size.
+
 _Fixes:_
 
+- Fixed an issue where clip size for PDFs would on rare occation be invalid, causing the export to fail
+- Fixed an issue where the chart constructor was sometimes incorrectly set, causing the export to fail
+- Added referrers to CDN cache fetches on first startup/install. 
+- Fixed an issue that would sometimes cause cause a crash due to fail due to `Accept-Ranges` headers
 - Fixed the warning message when the the default `resources.json` file is not found.
-- Fixed the problem with the lack of the `instr` value, when the `options` is set instead.
+- Fixed the problem with the lack of the `instr` value, when the `options` is set instead
 
 # 4.0.2
 

README.md

@@ -214,6 +214,7 @@ The format, along with its default values, is as follows (using the recommended
     "host": "0.0.0.0",
     "port": 7801,
     "benchmarking": false,
+    "maxUploadSize": 3,
     "proxy": {
       "host": "",
       "port": 8080,
@@ -316,6 +317,7 @@ These variables are set in your environment and take precedence over options fro
 - `SERVER_HOST`: The hostname of the server. Additionally, it starts a server listening on the provided hostname (defaults to `0.0.0.0`).
 - `SERVER_PORT`: The port to be used for the server when enabled (defaults to `7801`).
 - `SERVER_BENCHMARKING`: Indicates whether to display a message with the duration, in milliseconds, of specific actions that occur on the server while serving a request (defaults to `false`).
+- `SERVER_MAX_UPLOAD_SIZE`: The maximum size, in MB, of uploaded files (defaults to `3`).
 
 ### Server Proxy Config
 
@@ -413,6 +415,7 @@ _Available options:_
 - `--enableServer`: If set to **true**, the server starts on 0.0.0.0 (defaults to `false`).
 - `--host`: The hostname of the server. Additionally, it starts a server listening on the provided hostname (defaults to `0.0.0.0`).
 - `--port`: The port to be used for the server when enabled (defaults to `7801`).
+- `--maxUploadSize`: The maximum size, in MB, of files uploaded through the server (defaults to `3`).
 - `--serverBenchmarking`: Indicates whether to display the duration, in milliseconds, of specific actions that occur on the server while serving a request (defaults to `false`).
 - `--proxyHost`: The host of the proxy server to use, if it exists (defaults to `false`).
 - `--proxyPort`: The port of the proxy server to use, if it exists (defaults to `false`).

dist/index.cjs

@@ -28,24 +28,36 @@ async function fetch(url, requestOptions = {}) {
     const protocol = getProtocol(url);
 
     protocol
-      .get(url, requestOptions, (res) => {
-        let data = '';
+      .get(
+        url,
+        Object.assign(
+          {
+            headers: {
+              'User-Agent': 'highcharts/export',
+              Referer: 'highcharts/export'
+            }
+          },
+          requestOptions || {}
+        ),
+        (res) => {
+          let data = '';
 
-        // A chunk of data has been received.
-        res.on('data', (chunk) => {
-          data += chunk;
-        });
+          // A chunk of data has been received.
+          res.on('data', (chunk) => {
+            data += chunk;
+          });
 
-        // The whole response has been received.
-        res.on('end', () => {
-          if (!data) {
-            reject('Nothing was fetched from the URL.');
-          }
+          // The whole response has been received.
+          res.on('end', () => {
+            if (!data) {
+              reject('Nothing was fetched from the URL.');
+            }
 
-          res.text = data;
-          resolve(res);
-        });
-      })
+            res.text = data;
+            resolve(res);
+          });
+        }
+      )
       .on('error', (error) => {
         reject(error);
       });

dist/index.esm.js

@@ -31,7 +31,11 @@ import DOMPurify from 'dompurify';
 export function sanitize(input) {
   const window = new JSDOM('').window;
   const purify = DOMPurify(window);
-  return purify.sanitize(input, { ADD_TAGS: ['foreignObject'] });
+  return purify.sanitize(input, {
+    ADD_TAGS: ['foreignObject'],
+    // Dissalow all xlinks in incoming SVG
+    FORBID_ATTR: ['xlink:href']
+  });
 }
 
 export default sanitize;

dist/index.esm.js.map

@@ -348,6 +348,15 @@ export const defaultConfig = {
     }
   },
   server: {
+    maxUploadSize: {
+      value: 3,
+      type: 'number',
+      cliName: 'maxUploadSize',
+      envLink: 'SERVER_MAX_UPLOAD_SIZE',
+      description:
+        'The maximum upload size, in megabytes, for the server'
+      
+    },
     enable: {
       value: false,
       type: 'boolean',

lib/fetch.js

@@ -52,29 +52,6 @@ app.use((_req, res, next) => {
   next();
 });
 
-// TODO: Read from config/env
-// NOTE:
-// Too big limits lead to timeouts in the export process when the
-// rasterization timeout is set too low.
-const uploadLimitMiB = 3;
-const uploadLimitBytes = uploadLimitMiB * 1024 * 1024;
-
-// Enable parsing of form data (files) with Multer package
-const storage = multer.memoryStorage();
-const upload = multer({
-  storage,
-  limits: {
-    fieldSize: uploadLimitBytes
-  }
-});
-
-// Enable body parser
-app.use(express.json({ limit: uploadLimitBytes }));
-app.use(express.urlencoded({ extended: true, limit: uploadLimitBytes }));
-
-// Use only non-file multipart form fields
-app.use(upload.none());
-
 /**
  * Attach error handlers to the server.
  *
@@ -113,6 +90,29 @@ const attachServerErrorHandlers = (server) => {
  */
 export const startServer = async (serverConfig) => {
   try {
+    // TODO: Read from config/env
+    // NOTE:
+    // Too big limits lead to timeouts in the export process when the
+    // rasterization timeout is set too low.
+    const uploadLimitMiB = serverConfig.maxUploadSize || 3;
+    const uploadLimitBytes = uploadLimitMiB * 1024 * 1024;
+
+    // Enable parsing of form data (files) with Multer package
+    const storage = multer.memoryStorage();
+    const upload = multer({
+      storage,
+      limits: {
+        fieldSize: uploadLimitBytes
+      }
+    });
+
+    // Enable body parser
+    app.use(express.json({ limit: uploadLimitBytes }));
+    app.use(express.urlencoded({ extended: true, limit: uploadLimitBytes }));
+
+    // Use only non-file multipart form fields
+    app.use(upload.none());
+
     // Stop if not enabled
     if (!serverConfig.enable) {
       return false;