Sanitizer breaks animated SVGs

Created on 19 October 2021, about 3 years ago
Updated 6 March 2024, 10 months ago

Problem/Motivation

I need a PURE svg output (not like the source of an image tag).
Some services like svgator.com create native svg animations. Thus come out with an embedded script tag inside svg code once it's exported.

Right now IT works as designed - pure SVG output is passed through the SvgSanitizer that strips away all UN-allowed tags (and script tag is one of them).

Steps to reproduce

Use an SVG with embedded animations.
Select the media display that outputs the image file within (which is svg) as SVG.
Formatter setting (Render SVG image as <img>) is UNchecked.
This will generate an output of svg tag with the precious script tag animations stripped of - so no animation at all.

Proposed resolution

Add the possibility to choose whether or not sanitize the svg source.
I know it's a possible security drawback, but given the permission to only restricted set of people who can edit and manage this contents.
As result it'll add another checkbox on formatter settings form (to avoid sanitizing)

Remaining tasks

Test my patch

User interface changes

Image Formatter settings form has new boolean checkbox.
Now the state of Render SVG image as <img> toggles the state of visibility of new Checkbox and Fieldset for image width / height.

EXAMPLE

Download .mov video

Feature request
Status

Needs review

Version

1.15

Component

Code

Created by

🇮🇹Italy eglaw Cittadella

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇬🇷Greece balis_m

    Patch from #2 doesn' t apply to the current dev version. So, I rerolled it.

  • Issue was unassigned.
  • 🇸🇮Slovenia deaom

    The patch does no longer apply to the latest version (3.1.0). Attaching the adjusted patch.
    As there is a difference between current release and dev version (dev uses trait), attaching a patch for dev as well.
    Marked as needs review.

Production build 0.71.5 2024