SVGs are very powerful tools. They can include malicious code. As part of robust protection against malicious uploads, Drupal could filter (sanitize) SVG files on upload.
In general Drupal handles input as:
However, that strategy isn't as appropriate in the case of public files since they are generally served directly by the webserver, avoiding a Drupal bootstrap, and, therefore, cannot be filtered by Drupal at the time of display.
Upload a malicious SVG. Drupal accepts it and will let people download it and upload it to a new site.
Integrate a tool (perhaps SVG Sanitizer → ) into the upload process.
Evaluate and decide on a tool for this purpose.
Add it.
TBD.
TBD.
TBD.
TBD.
TBD.
Postponed
11.1 🔥
file system
Creating this as a postponed followup to #2868079: Add a default Content-Security-Policy-header for svg files → to provide a more robust solution to a wider set of problems.
The SVG Image → module does sanitization in the Formatter. https://git.drupalcode.org/project/svg_image/-/blob/3.x/src/Plugin/Field...