Page MenuHomePhabricator

Relax aggressive checkSvgScriptCallback() in UploadBase.php which prevents upload of some script-less Inkscape SVGs
Closed, ResolvedPublicBUG REPORT

Description

Originally reported in Inkscape's bugtracker at https://gitlab.com/inkscape/inbox/-/issues/5395 by rebio

What happens?:

  • Upload failed, with the following warning
    • Found event-handler attribute only_selected="false" in uploaded file.

What should have happened instead?:

This is caused by the check on https://github.com/wikimedia/mediawiki/blob/master/includes/upload/UploadBase.php#L1670 [(https://github.com/wikimedia/mediawiki/blob/de91a0db45eaf31b57873b9d22aceaaa3d1be09a/includes/upload/UploadBase.php#L1670)] being WAY too aggressive : they check for any properties starting with "on" (reasonable given the list of properties in https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers ) in any element from any namespace which is the part that makes no sense : things in a <inkscape:path-effect> element will not get processed by a browser so there is no reason to clear its properties.

Event Timeline

Aklapper renamed this task from checkSvgScriptCallback too aggressive, preventing upload of some script-less Inkscape svgs. to Relax aggressive checkSvgScriptCallback() in UploadBase.php which prevents upload of some script-less Inkscape SVGs.Aug 5 2021, 8:19 AM
Aklapper added a project: MediaWiki-Uploading.

Change 876015 had a related patch set uploaded (by TheDJ; author: TheDJ):

[mediawiki/core@master] Allow attributes starting with on in inkscape namespace

https://gerrit.wikimedia.org/r/876015

Change 876015 merged by jenkins-bot:

[mediawiki/core@master] upload: Allow attributes starting with "on" in inkscape SVG namespace

https://gerrit.wikimedia.org/r/876015

TheDJ claimed this task.

Thank you for fixing the issue TheDJ :)