# Marker element נשמט מקובץ SVG שהועלה

**URL:** <https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432>\
**Category:** Bug\
**Created:** [18 בספטמבר,‏ 2020,‏ 8:54am UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432 "2020-09-18T08:54:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![anthonydillon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/anthonydillon/32/163123_2.png) [@anthonydillon](https://meta.discourse.org/u/anthonydillon)\
**Post date:** [18 בספטמבר,‏ 2020,‏ 8:54am UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/1 "2020-09-18T08:54:44Z")

</div>

When uploading an SVG the resulting SVG has removed `marker` elements. Is there a way to stop this from happening?

Example:

 ![dex-unauthenticated](https://global.discourse-cdn.com/meta/original/3X/1/f/1f8d32c0717747c8a598c50d23a5c8d049e0a8c8.svg)

The raw image can be found here:  
[https://raw.githubusercontent.com/juju-solutions/bundle-kubeflow/1c76d8a0292f0a969f1ce416767ff3d5847508ca/docs/img/dex-unauthenticated.svg](https://raw.githubusercontent.com/juju-solutions/bundle-kubeflow/1c76d8a0292f0a969f1ce416767ff3d5847508ca/docs/img/dex-unauthenticated.svg)

---

<div class="post-metadata">

**Author:** ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)\
**Post date:** [18 בספטמבר,‏ 2020,‏ 11:13am UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/2 "2020-09-18T11:13:11Z")

</div>

I guess we can add the `<marker>` element to the allowlist. I don’t see any [attributes](https://developer.mozilla.org/en-US/docs/Web/SVG/Element/marker#Attributes) that affect security.

> <https://github.com/discourse/discourse/blob/ce686a008f97708099efbe9969d1a83f8b8950cf/lib/upload_creator.rb#L9-L13>

---

<div class="post-metadata">

**Author:** ![anthonydillon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/anthonydillon/32/163123_2.png) [@anthonydillon](https://meta.discourse.org/u/anthonydillon)\
**Post date:** [18 בספטמבר,‏ 2020,‏ 3:54pm UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/3 "2020-09-18T15:54:14Z")

</div>

Thank you, [filed a PR](https://github.com/discourse/discourse/pull/10703) to have `marker` added to the allowlist when uploading an SVG.

---

<div class="post-metadata">

**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\
**Post date:** [18 בספטמבר,‏ 2020,‏ 7:33pm UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/4 "2020-09-18T19:33:51Z")

</div>

For reference WebKit has had security problems with the marker element. The last issue was an RCE in December.

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [6 ביולי,‏ 2021,‏ 1:08am UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/5 "2021-07-06T01:08:38Z")

</div>

Thanks for the fix @anthonydillon !

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [6 ביולי,‏ 2021,‏ 1:08am UTC](https://meta.discourse.org/t/marker-element-being-striped-out-from-uploaded-svg/164432/6 "2021-07-06T01:08:40Z")

</div>