Created on 1 October 2023, over 1 year ago

SVG could be dangerous, especially coming from an external site. However, even not enabled by default, there should be a way for devs that know what they are doing to add SVG support. Here's a proposal:

  • Move the hardcoded list of extensions into a config, so that a site admin is able to add .svg to the list
  • Before saving the file content, dispatch a hook that allows 3rd-party to perform sanitization on the downloaded file. Allow the subscribers to cancel the file saving if they aren't able to sanitize the file.

Alternatively (more secure), depend on enshrined/svg-sanitize and do the sanitization by default.

I prefer the 2nd options as is more secure,

✨ Feature request
Status

Active

Version

3.0

Component

Code

Created by

πŸ‡·πŸ‡΄Romania claudiu.cristea Arad πŸ‡·πŸ‡΄

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024