Skip to content

Harden SVG path parser and add tests for robustness#389

Merged
JimBobSquarePants merged 3 commits intomainfrom
js/fix-385
May 10, 2026
Merged

Harden SVG path parser and add tests for robustness#389
JimBobSquarePants merged 3 commits intomainfrom
js/fix-385

Conversation

@JimBobSquarePants
Copy link
Copy Markdown
Member

Prerequisites

  • I have written a descriptive pull-request title
  • I have verified that there are no overlapping pull-requests open
  • I have verified that I am following matches the existing coding patterns and practice as demonstrated in the repository. These follow strict Stylecop rules 👮.
  • I have provided test coverage for my change (where applicable)

Description

Fixes #385

This pull request significantly refactors and improves the robustness of the SVG path parsing logic in Path.cs, addressing edge cases and malformed input handling. The changes introduce stricter validation for SVG arc flags, ensure full operand groups are parsed before appending geometry, and replace several parsing helpers with safer, more explicit methods. Additionally, new unit tests are added to verify correct handling of malformed arc data.

SVG Path Parsing Improvements:

  • Added strict parsing for SVG arc flags by introducing TryFindFlag, ensuring only valid "0" or "1" values are accepted and preventing malformed arc flag/end-point boundaries from being parsed incorrectly. [1] [2]
  • Refactored operand parsing to use TryFindPoint, TryFindScaler, and TryReadScalar, providing better error checking and preventing partially parsed segments from being added to the path. This also ensures that only complete operand groups are processed for each SVG command. [1] [2] [3] [4]
  • Improved handling of relative coordinates and validation of finite values for points and scalars, preventing overflows and invalid geometry from being accepted.

Code Quality and Safety Enhancements:

  • Replaced direct parsing (ParseFloat) with a safer TryParseFloat method that validates numeric input and ensures only finite floats are accepted.
  • Updated command handling logic to ensure that malformed or truncated SVG path data does not result in partial or incorrect geometry being added. [1] [2]

Testing:

  • Added new unit tests in Issue_385.cs to verify that malformed arc data is correctly rejected by TryParseSvgPath, increasing reliability for edge cases.

@JimBobSquarePants JimBobSquarePants added bug Something isn't working security labels May 10, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented May 10, 2026

Codecov Report

❌ Patch coverage is 77.50000% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 86%. Comparing base (f7de825) to head (3c92615).

Files with missing lines Patch % Lines
src/ImageSharp.Drawing/Path.cs 77% 11 Missing and 7 partials ⚠️
Additional details and impacted files
@@         Coverage Diff         @@
##           main   #389   +/-   ##
===================================
  Coverage    85%    86%           
===================================
  Files       107    107           
  Lines      8339   8353   +14     
  Branches   1066   1079   +13     
===================================
+ Hits       7168   7190   +22     
+ Misses      925    915   -10     
- Partials    246    248    +2     
Flag Coverage Δ
unittests 86% <77%> (+<1%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@JimBobSquarePants JimBobSquarePants merged commit 7f09902 into main May 10, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ImageSharp.Drawing crashes on malformed SVG path input (IOOB, ArithmeticException)

1 participant