@juspay/neurolink
Version:
The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002
38 lines (37 loc) • 1.77 kB
TypeScript
/**
* Content sniffing for text-shaped image formats.
*
* SVG is markup, so it has no byte signature — but it does have an unambiguous
* root element, and identifying it matters twice over: the detector routes SVG
* to the sanitizer rather than to a vision API, and the image path must not let
* SVG bytes travel under some other format's MIME type.
*
* ## Why this is a scan and not a regular expression
*
* The obvious implementation strips the prolog with a pattern like
* `(?:<!--[\s\S]*?-->\s*)*<svg`. That is two nested quantifiers, and CodeQL
* rightly flags it as `js/redos`: input beginning `<!--` and repeating
* `--><!--` drives exponential backtracking, so a hostile (or merely odd)
* upload can burn CPU inside what is supposed to be a cheap type check.
*
* The `.replace()`-chain alternative is unsound for a different reason —
* removing a multi-character construct can join the surrounding text into a
* fresh instance of that same construct, so one pass does not converge
* (`<!--<!-- -->-->` leaves a comment behind). CodeQL flags that shape too, as
* `js/incomplete-multi-character-sanitization`.
*
* A single forward scan has neither problem: the cursor only ever advances, so
* the work is linear in the input and no construct can re-form behind it.
*
* @module utils/markupSniff
*/
/**
* Whether the leading bytes are an SVG document.
*
* Requires `<svg` to be the *root element* rather than merely present, so an
* HTML page embedding an inline `<svg>` icon is not mistaken for a standalone
* image. A BOM, XML declaration, DOCTYPE and comments may precede it.
*
* @param input - Buffer or string to inspect; only the head is read.
*/
export declare function looksLikeSvgMarkup(input: Buffer | string): boolean;