mirror of
https://github.com/storytold/vectorcraft.git
synced 2026-11-14 06:31:41 +00:00
dotCooCoo
b7709a3c1f
An SVG or SVGZ writes each linked JavaScript file of SVG Interactivity into a <script xlink:href> element as stored, so a caller with automation read roots could read a path outside them from the exported text. With read roots in force, an SVG or SVGZ of a document that links such a file is now refused with "a linked JavaScript file is outside the read roots", an error that names no file or folder. No file or folder is written, and the document keeps the link. - The check uses the rule document.json already applies to svg_scripts: a relative path is taken from the document's folder, a file: URL is a file, and another URL is not checked. - It covers document.serialize, document.export, document.exportSelection, document.exportForScreens and assets.export (before the folder is made or any row is written), the SVG and SVGZ saves (also a save without a path of a document saved as SVG), file.exportAs and the SVG Options dialog's Show Code. - Callers without roots, and the person at the keyboard, export the links as stored. Docs: docs/mcp.md, docs/target-app-parity.md.