Merge commit from fork

Match JavaScript URIs case insensitively, such as JAVASCRIPT or
JavaScript.

Match <*:script> elements that are explicitly namespaced/prefixed with
the SVG namespace or XHTML namespace. We leave intact any other
namespace like a custom <filmmaker:script> script which isn't
executable.

Author: SethFalco

lib/svgo/tools.js

@@ -162,7 +162,7 @@ const hasScripts = (node) => {
       ([attrKey, attrValue]) =>
         (attrKey === 'href' || attrKey.endsWith(':href')) &&
         attrValue != null &&
-        attrValue.trimStart().startsWith('javascript:'),
+        attrValue.trimStart().toLowerCase().startsWith('javascript:'),
     );
 
     if (hasJsLinks) {

package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@2.4.3",
   "name": "svgo",
-  "version": "3.3.3",
+  "version": "3.3.4",
   "description": "Nodejs-based tool for optimizing SVG vector graphics files",
   "license": "MIT",
   "keywords": [

plugins/removeScriptElement.js

@@ -15,6 +15,37 @@ const eventAttrs = [
   ...attrsGroups.graphicalEvent,
 ];
 
+/** Namespaces that support executable <script> elements. */
+const SCRIPT_NAMESPACES = [
+  'http://www.w3.org/2000/svg',
+  'http://www.w3.org/1999/xhtml',
+];
+
+/**
+ * @param {string} elem
+ * @param {string} targetElem
+ * @param {ReadonlyMap<string, string[]>} prefixes
+ * @param {string[]} targetNamespaces
+ * @returns {boolean}
+ */
+function isNamespaceAwareElem(elem, targetElem, prefixes, targetNamespaces) {
+  if (elem === targetElem) {
+    return true;
+  }
+
+  if (elem.includes(':')) {
+    const [prefix, effectiveTag] = elem.split(':', 2);
+
+    if (targetElem === effectiveTag) {
+      const namespaces = /** @type {string[]} */ (prefixes.get(prefix));
+      const namespace = namespaces[namespaces.length - 1];
+      return targetNamespaces.includes(namespace);
+    }
+  }
+
+  return false;
+}
+
 /**
  * Remove scripts.
  *
@@ -24,10 +55,34 @@ const eventAttrs = [
  * @type {import('./plugins-types').Plugin<'removeScriptElement'>}
  */
 exports.fn = () => {
+  /**
+   * Map of XML namespace prefixes to the XML namespace. Each value is a stack
+   * as XML namespaces can be pushed to in children elements and revert back
+   * previous namespace when we exit that node.
+   *
+   * @type {Map<string, string[]>} */
+  const prefixes = new Map();
+
   return {
     element: {
       enter: (node, parentNode) => {
-        if (node.name === 'script') {
+        for (const [k, v] of Object.entries(node.attributes)) {
+          if (!k.startsWith('xmlns:')) {
+            continue;
+          }
+
+          const prefix = k.slice(6);
+
+          if (!prefixes.has(prefix)) {
+            prefixes.set(prefix, [v]);
+          } else {
+            /** @type {string[]} */ (prefixes.get(prefix)).push(v);
+          }
+        }
+
+        if (
+          isNamespaceAwareElem(node.name, 'script', prefixes, SCRIPT_NAMESPACES)
+        ) {
           detachNodeFromParent(node, parentNode);
           return;
         }
@@ -39,6 +94,15 @@ exports.fn = () => {
         }
       },
       exit: (node, parentNode) => {
+        for (const k of Object.keys(node.attributes)) {
+          if (!k.startsWith('xmlns:')) {
+            continue;
+          }
+
+          const prefix = k.slice(6);
+          /** @type {string[]} */ (prefixes.get(prefix)).pop();
+        }
+
         if (node.name !== 'a') {
           return;
         }
@@ -47,7 +111,10 @@ exports.fn = () => {
           if (attr === 'href' || attr.endsWith(':href')) {
             if (
               node.attributes[attr] == null ||
-              !node.attributes[attr].trimStart().startsWith('javascript:')
+              !node.attributes[attr]
+                .trimStart()
+                .toLowerCase()
+                .startsWith('javascript:')
             ) {
               continue;
             }