# Avatars with .svg extension dont loaded in 2.2.0.beta3 +64 version

**URL:** https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898
**Category:** Bug
**Created:** [18 oktober 2018 om 18:58 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898 "2018-10-18T18:58:01Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![jandres](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jandres/32/130933_2.png) [@jandres](https://meta.discourse.org/u/jandres)
#### Post date: [18 oktober 2018 om 18:58 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/1 "2018-10-18T18:58:01Z")

</div>

I am trying from a while to upload an svg image for my avatar but it’s impossible.

When a update to 2.2.0.beta3 +64 version, all user having avatar image with svg extension was replaced by default image

 ![image](https://global.discourse-cdn.com/meta/original/3X/d/8/d8b5d0a738295345ebd8934b859fa1fca1c8c6ad.jpeg)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [18 oktober 2018 om 20:23 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/2 "2018-10-18T20:23:33Z")

</div>

I am not sure we even want to support this cc @tgxworld ?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [19 oktober 2018 om 03:16 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/3 "2018-10-19T03:16:56Z")

</div>

Yeah we should block svg avatars

---

<div class="post-metadata">

### Author: ![tgxworld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tgxworld/32/106117_2.png) [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [19 oktober 2018 om 08:16 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/5 "2018-10-19T08:16:45Z")

</div>

I had a look here and confirmed this is a regression.

> <https://github.com/discourse/discourse/blob/5f86564da1bc7c921bf1ed791b3ebc00b5917525/app/models/optimized_image.rb#L32>

There was a change made to use `IM_DECODERS` to verify if an image can be optimized but we actually don’t need to optimize SVGs at all. What used to happen in the previous versions is that SVG “optimized images” are basically a copy of the original image.

> <https://github.com/discourse/discourse/blob/5f86564da1bc7c921bf1ed791b3ebc00b5917525/app/models/optimized_image.rb#L79-L80>

I think we should just avoid creating optimized images for SVG altogether and retain support.

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [19 oktober 2018 om 08:28 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/7 "2018-10-19T08:28:22Z")

</div>

Do we do anything to strip script tags from within SVG? Are they handled as `<img>` or `<object>`?

---

<div class="post-metadata">

### Author: ![jandres](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jandres/32/130933_2.png) [@jandres](https://meta.discourse.org/u/jandres)
#### Post date: [19 oktober 2018 om 13:53 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/10 "2018-10-19T13:53:33Z")

</div>

> [@sam](#):
>
> Yeah we should block svg avatars

There are a real problem to handle svg images as avatars?

Until now, the avatar images in svg have worked perfectly. I don’t understand why the headache

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [19 oktober 2018 om 23:50 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/11 "2018-10-19T23:50:03Z")

</div>

Too much of a security and performance and complexity risk. Nobody _needs_ a SVG avatar.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7 november 2018 om 04:31 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/12 "2018-11-07T04:31:02Z")

</div>

We had a bunch of internal regressions around svg support, very few noticed it cause very few bother whitelisting svgs.

This is now fixed:

[https://github.com/discourse/discourse/commit/0a442e319c45b91a2ce7b59efad1045596a323dd](https://github.com/discourse/discourse/commit/0a442e319c45b91a2ce7b59efad1045596a323dd)

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [7 november 2018 om 05:48 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/13 "2018-11-07T05:48:22Z")

</div>

So SVG now works, except as avatars?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7 november 2018 om 05:49 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/14 "2018-11-07T05:49:44Z")

</div>

If SVG is the poison you are into drinking and you enable it, it works for avatars and inside posts.

It was pretty broken previously.

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [7 november 2018 om 06:10 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/15 "2018-11-07T06:10:58Z")

</div>

You both agreed above that they were a Very Bad Idea only three weeks ago, out of curiosity what changed?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7 november 2018 om 06:15 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/16 "2018-11-07T06:15:11Z")

</div>

> [@Stephen](#):
>
> what changed?

It was easier just to fix the underlying bug. It is more work to block it and add a test for blocking it, the risk of allowing svg avatars is not too high.

I will probably revisit this and block it unconditionally though cause there are just too many edge cases which make me uneasy.

In particular you could set an svg avatar to say a 500k image and that is the thumbnail and everything, that would be brutal, fixing that edge case is not worth the effort.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [10 november 2018 om 07:00 UTC](https://meta.discourse.org/t/avatars-with-svg-extension-dont-loaded-in-2-2-0-beta3-64-version/99898/17 "2018-11-10T07:00:05Z")

</div>

This topic was automatically closed after 3 days. New replies are no longer allowed.
