Page MenuHomePhabricator

Introduce an SVG Sanitizer
Open, Needs TriagePublic

Description

Similar to the existing CSS Sanitizer, a whitelist-based sanitizer will ensure the SVG cannot be used for anything dangerous.

This task is directly influenced by T334940: All Graphs broken on Wikimedia wikis (due to security issue T336556) (although I am not able to see the restricted subtask).

See also: T96461: Systematic sanitization for SVGs and HTML, T86874: Make SVG sanitization into a library (the current sanitizer is not considered safe enough for SVG to be directly embeded client-side)
See also parent tasks