- <%= render 'shared/logo', width: 50, height: 50, class: 'mx-auto animate-bounce' %>
+ <%= render 'shared/account_logo', account: current_account, width: 50, height: 50, class: 'mx-auto animate-bounce' %>
<%= t('processing') %>...
diff --git a/config/routes.rb b/config/routes.rb
index 5bdad31d..0cf74373 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -206,6 +206,7 @@ Rails.application.routes.draw do
resources :integration_users, only: %i[index], path: 'users/:status', controller: 'users',
defaults: { status: :integration }
resource :personalization, only: %i[show create], controller: 'personalization_settings'
+ resource :account_logo, only: %i[create destroy], controller: 'account_logo'
resources :webhooks, only: %i[index show new create update destroy], controller: 'webhook_settings' do
post :resend
diff --git a/lib/account_logo.rb b/lib/account_logo.rb
new file mode 100644
index 00000000..e8bbf67c
--- /dev/null
+++ b/lib/account_logo.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+# AccountLogo handles validation/sanitization of uploads before they hit
+# ActiveStorage. Raster images pass through unchanged. SVGs are scrubbed of
+# scripts, event-handler attributes, foreign-object elements, and external
+# resource references — the standard XSS surface for inline-embedded SVG.
+module AccountLogo
+ Sanitized = Struct.new(:io, :filename, :content_type)
+
+ # Allowed top-level/nested SVG-related element + attribute names that
+ # carry external resource URIs. We don't enumerate every safe attribute —
+ # we instead drop the known-dangerous ones by name pattern.
+ EVENT_HANDLER_PREFIX = 'on'
+ EXTERNAL_REF_ATTRS = %w[href xlink:href].freeze
+
+ module_function
+
+ def sanitize_upload(uploaded_file)
+ content_type = uploaded_file.content_type.to_s
+
+ if content_type == 'image/svg+xml'
+ bytes = uploaded_file.read
+ uploaded_file.rewind if uploaded_file.respond_to?(:rewind)
+ cleaned = sanitize_svg(bytes)
+ Sanitized.new(StringIO.new(cleaned), uploaded_file.original_filename.to_s, 'image/svg+xml')
+ else
+ io = uploaded_file.respond_to?(:tempfile) ? uploaded_file.tempfile : uploaded_file
+ Sanitized.new(io, uploaded_file.original_filename.to_s, content_type)
+ end
+ end
+
+ # Public for spec testing.
+ def sanitize_svg(svg_string)
+ doc = Nokogiri::XML(svg_string) { |c| c.nonet.noblanks }
+
+ doc.traverse do |node|
+ next unless node.element?
+
+ local = node.name.to_s.downcase.sub(/.*:/, '')
+ if local == 'script' || local == 'foreignobject'
+ node.remove
+ next
+ end
+
+ node.attributes.each_value do |attr|
+ name = attr.name.to_s
+ downcased = name.downcase
+
+ if downcased.start_with?(EVENT_HANDLER_PREFIX)
+ node.remove_attribute(name)
+ next
+ end
+
+ if EXTERNAL_REF_ATTRS.include?(downcased) || downcased.end_with?(':href')
+ value = attr.value.to_s.strip
+ unless value.start_with?('#') || value.start_with?('data:')
+ node.remove_attribute(name)
+ end
+ end
+ end
+ end
+
+ doc.to_xml
+ end
+end
diff --git a/lib/pdf_icons.rb b/lib/pdf_icons.rb
index d9beab6e..34a39b72 100644
--- a/lib/pdf_icons.rb
+++ b/lib/pdf_icons.rb
@@ -20,6 +20,26 @@ module PdfIcons
StringIO.new(logo_data)
end
+ # Returns binary IO for the account's uploaded logo when attached,
+ # otherwise the default WaboSign mark. SVG uploads are rasterised via
+ # ActiveStorage variants (libvips + librsvg ship in the production image
+ # via the `vips` Alpine package). On any failure path we fall back to the
+ # default mark so audit-trail generation never crashes on a bad logo.
+ def account_logo_io(account)
+ return logo_io if account.nil? || !account.logo.attached?
+
+ blob = account.logo
+ if blob.content_type == 'image/svg+xml'
+ variant = blob.variant(resize_to_limit: [WIDTH, HEIGHT], format: :png).processed
+ StringIO.new(variant.download)
+ else
+ StringIO.new(blob.download)
+ end
+ rescue StandardError => e
+ Rails.logger.warn("[PdfIcons] account_logo_io fallback for account=#{account&.id}: #{e.class}: #{e.message}")
+ logo_io
+ end
+
def stamp_logo_io
StringIO.new(stamp_logo_data)
end
diff --git a/lib/submissions/generate_audit_trail.rb b/lib/submissions/generate_audit_trail.rb
index 45d04048..1671ccec 100644
--- a/lib/submissions/generate_audit_trail.rb
+++ b/lib/submissions/generate_audit_trail.rb
@@ -530,8 +530,9 @@ module Submissions
!submission.source.in?(%w[embed api])
end
- def add_logo(column, _submission = nil)
- column.image(PdfIcons.logo_io, width: 40, height: 40, position: :float)
+ def add_logo(column, submission = nil)
+ column.image(PdfIcons.account_logo_io(submission&.account),
+ width: 40, height: 40, position: :float)
column.formatted_text([{ text: Wabosign.product_name,
link: Wabosign::PRODUCT_EMAIL_URL }],
diff --git a/spec/lib/account_logo_spec.rb b/spec/lib/account_logo_spec.rb
new file mode 100644
index 00000000..e9ce08e2
--- /dev/null
+++ b/spec/lib/account_logo_spec.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe AccountLogo do
+ describe '.sanitize_svg' do
+ it 'removes
+
+
+ SVG
+
+ cleaned = described_class.sanitize_svg(svg)
+
+ expect(cleaned).not_to include('
elements' do
+ svg = 'malicious
+
+ SVG
+
+ cleaned = described_class.sanitize_svg(svg)
+
+ expect(cleaned).not_to include('https://attacker.example')
+ expect(cleaned).to include('#circle')
+ expect(cleaned).to include('data:image/png')
+ end
+ end
+
+ describe '.sanitize_upload' do
+ it 'returns the original tempfile for PNG uploads' do
+ png_bytes = File.binread(Rails.root.join('public/favicon-32x32.png'))
+ file = ActionDispatch::Http::UploadedFile.new(
+ tempfile: Tempfile.new(['logo', '.png']).tap { |t| t.binmode; t.write(png_bytes); t.rewind },
+ filename: 'logo.png', type: 'image/png'
+ )
+
+ result = described_class.sanitize_upload(file)
+
+ expect(result.content_type).to eq('image/png')
+ expect(result.filename).to eq('logo.png')
+ end
+
+ it 'sanitises SVG content and returns a StringIO with cleaned bytes' do
+ svg = '