fix(Gradient): escape colorStop colors in SVG export (backport GHSA-w22m to 6.x)

[greymoth-jp]

The 6.x line is missing the gradient colorStop escaping that shipped on the active major in v7.4.0 for GHSA-w22m-hvvm-xmwx. On 6.9.1, Gradient.toSVG() inlines each colorStop color straight into the style="stop-color:..." attribute with no escaping, so a crafted color breaks out of the attribute and injects arbitrary SVG. This is reachable whenever a gradient comes from untrusted input (e.g. loadFromJSON) and the canvas is later serialized with toSVG().

Repro on 6.9.1:

const g = new Gradient({
  type: 'linear',
  colorStops: [{ offset: 0, color: 'red"><img src=x onerror=alert(1)>' }],
});
g.toSVG(new Rect({ width: 100, height: 100, fill: g }));
// <stop offset="0%" style="stop-color:red"><img src=x onerror=alert(1)>;"/>

This backports the v7.4.0 fix: a value that is not a safe SVG style token is normalized through Color(...).toRgba(), and the result is passed through escapeXml for the attribute context. Because style="stop-color:..." is a CSS declaration, XML-escaping alone is not enough, hence the normalization step. Safe values (currentColor, var(--x), rgb(...), named colors) are left as-is, so existing output is preserved.

escapeXml already exists on 6.x; the only new file is the isSafeSvgStyleValue helper, copied from the v7 implementation. Added unit tests covering the HTML, CSS-declaration and url payloads plus the safe-value passthrough.

Oracle: GHSA-w22m-hvvm-xmwx, fixed on the active major in v7.4.0.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[greymoth-jp]

Closing this since CI is red and I can't verify it properly. I'd rather not leave a broken PR in your queue. Sorry for the noise.

[asturur]

No worries i ll get here. I have just to be sure things work properly.