- Issue created by @satwantsinghbhatia
Allowing SVG extension is the same as allowing HTML extension. It requires a more advanced filtering(considering onX attributes) than the one in your patch. IMCE supports svg files to be previewed using the IMG tag, which is safe. Other than that the risk is the same as HTML files. A standalone SVG is as dangerous as a standalone HTML page. If you choose to allow html from your users you should take care of it using a custom module/configuration.