If I'm reading this right, and I'd like to think that I am, the "fix" is to change this line in UploadVerification.php from

			if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i", $value ) ) {

to

			if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png|webp)$parameters,!i", $value ) ) {

The only thing I'm not sure of is if WebP allows for anything, as a format, that would be undesirable to allow through without additional checking.

The only thing I'm not sure of is if WebP allows for anything, as a format, that would be undesirable to allow through without additional checking.

WebP is fine as a format

The only possible concern is does librsvg allow embedding webp files, but even if it doesn't, i think that's a separate question from if the upload filter should allow them.

Of course if someone embeds an animated webp file its not going to work, but that's the same as embedding a gif.

Change #1186596 had a related patch set uploaded (by Brian Wolff; author: Brian Wolff):

[mediawiki/core@master] Allow SVG with embedded raster images use modern formats for raster file

https://gerrit.wikimedia.org/r/1186596

In T404129#11165034, @Bawolff wrote:

The only thing I'm not sure of is if WebP allows for anything, as a format, that would be undesirable to allow through without additional checking.

WebP is fine as a format

Just making sure. =)

In T404129#11165045, @Bawolff wrote:

The only possible concern is does librsvg allow embedding webp files, but even if it doesn't, i think that's a separate question from if the upload filter should allow them.

Of course if someone embeds an animated webp file its not going to work, but that's the same as embedding a gif.

Assuming librsvg is referring to Gnome librsvg, according to the docs:

The image and feImage elements allow including an external file as raster data. Librsvg supports loading JPEG, PNG, GIF, and WEBP. Librsvg can optionally be compiled with support for AVIF, too; see the “Compile-time options” section in Detailed compilation instructions for details.

It looks like WebP support was added the same time GIF was added, in December 2023. AVIF was added at some point later, FWIW, though apparently it is considered optional and support must be explicitly requested during compilation.

In the patch it seemed best just to add all the modern formats web browsers support.

You got me curious, I'm not objecting to your patch. =)

Change #1186596 merged by jenkins-bot:

[mediawiki/core@master] Allow SVG with embedded raster images use modern formats for raster file

https://gerrit.wikimedia.org/r/1186596