Steps to Reproduce:

• Try to upload an SVG file with the XML declaration <?xml version='1.0' encoding='us-ascii' standalone='no'?>

Actual Results:

• Error message:

This file contains HTML or script code that may be erroneously interpreted by a web browser. See the FAQ for more information.

Expected Results:

Successful upload.

Workaround:

Change encoding='us-ascii' to encoding='utf-8'.

Notes:

After a discussion in IRC, @AntiCompositeNumber in #wikimedia-commons found that the problem is the encoding. This encoding is rather strange, but it wasn't a conscious decision by me. Several XML creators, including Python's xml.etree, now keep track of whether any character in the document is non-ASCII, and if not, they tag the whole document us-ascii. Therefore, this encoding should be added to $safeXmlEncodings. I can't think of a reason ASCII would be less safe than UTF-8.