SVG compatibility in Images by default

[john-doe]

Greetings.

I've been experimenting with SVG files. And i have been thinking why Joomla does not upload them through the uploaders and media manager. The point is i'm setting images via the interface and changing manually the image location to the SVG file manually (using JCE Editor's image dialog) and there it is admitted.

I'm not sure how viable is that SVG can be admitted into the image formats for upload.

Anyway is an idea i had.

Thanks for reading

[brian]

The reason why they are not enabled by default is that they are a potential security issue

[john-doe]

The reason why they are not enabled by default is that they are a potential security issue

I had no idea about it.

Do you know where can i get more detailed information about that security issue?

[brian]

You can add javascript code right inside the svg element.

Google is your friend for more information

[john-doe]

You can add javascript code right inside the svg element.

How so? I do my SVGs in Adobe Illustrator and i set the SVG files inside of IMG tags. i searched but i can't understand much (I'm graphic designer)

[brian]

Sorry I am not going to explain how to make an SVG that can be used to attack a web site

[john-doe]

Sorry I am not going to explain how to make an SVG that can be used to attack a web site

I DID NOT ASKED FOR THAT

[deleted user]

That's essentially the answer you would get though. SVG syntax is structured in a way that it's much easier to create files with exploits in them than "normal" image files and thus far there isn't a good method to scan those files to determine if they're exploited and block the upload.