Rillke's SVG converter is used in several SVG tools. It shows how librsvg renders an SVG file.

Direct path to Rillke converter:

• https://convert.toolforge.org/

Steps to replicate the issue (include links if applicable):

• On Commons, add User:Rillke/SVGedit.js to Common.js
• Go to an SVG file (such as Commons File:Test.svg)
• Click the "Edit SVG" menu item on the "Edit" tab
• Click the preview button

Alternatively

• Go to https://commons.wikimedia.org/w/index.php?title=Commons:Commons_SVG_Checker&withJS=MediaWiki:CommonsSvgChecker.js
• enter File:Test.svg
• click Execute SVG Check

Some notes about this method:

• the request header has Content-Type: application/octet-stream rather than image/svg+xml
• the response seems to return appropriate content, but response header has

Content-Disposition: attachment; filename="input.svg.png"Content-Length: 14436
Content-Security-Policy-Report-Only: default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: filesystem: mediastream: *.toolforge.org wikibooks.org *.wikibooks.org wikidata.org *.wikidata.org wikimedia.org *.wikimedia.org wikinews.org *.wikinews.org wikipedia.org *.wikipedia.org wikiquote.org *.wikiquote.org wikisource.org *.wikisource.org wikiversity.org *.wikiversity.org wikivoyage.org *.wikivoyage.org wiktionary.org *.wiktionary.org *.wmcloud.org *.wmflabs.org wikimediafoundation.org mediawiki.org *.mediawiki.org wss://convert.toolforge.org; report-uri https://csp-report.toolforge.org/collect;
Content-Type: image/png

What happens?:
The angry SVG Bug displays instead of a preview of the file.

The console reports

Referrer Policy: Ignoring the less restricted referrer policy “origin-when-cross-origin” for the cross-site request: https://convert.toolforge.org/svg2png.php index.php:322:8
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://convert.toolforge.org/svg2png.php. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

The response builds an appropriate PNG, but the response does not have an Access-Control-Allow-Origin: *, so browsers block the display.

What should have happened instead?:
The SVG image should display.

Software version (skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

@Rillke is no longer active.

See https://commons.wikimedia.org/w/index.php?title=Commons:Village_pump/Technical&diff=prev&oldid=799831326#RSVG_rendering_preview_on_user:Rillke/MwJSBot.js_not_working

See T217362

Significantly, the toolforge svg2png.php does not behave like the source at Github.

• https://github.com/Rillke/convert

Also, Github source is incomplete; it does not contain the domain matching code. Also does not show the slicker UI.

The toolforge version does not do the domain test (which would return an error) and it does not supply the Access-Control-Allow-Origin header. Perhaps someone modified the source code used by toolforge.

Ignoring the domain test is a good idea, but appropriate headers should be returned.

Content-Disposition: attachment seems a bit odd. It forces a download rather than displaying the PNG.