Marker element being striped out from uploaded SVG

기여 버그
1

When uploading an SVG the resulting SVG has removed marker elements. Is there a way to stop this from happening?

Example:

dex-unauthenticated
dex-unauthenticated325×300 11.5 KB

The raw image can be found here:
https://raw.githubusercontent.com/juju-solutions/bundle-kubeflow/1c76d8a0292f0a969f1ce416767ff3d5847508ca/docs/img/dex-unauthenticated.svg

1개의 좋아요
2

I guess we can add the <marker> element to the allowlist. I don’t see any attributes that affect security.

4개의 좋아요
3

Thank you, filed a PR to have marker added to the allowlist when uploading an SVG.

4개의 좋아요
4

For reference WebKit has had security problems with the marker element. The last issue was an RCE in December.

1개의 좋아요
5

Thanks for the fix @anthonydillon !

1개의 좋아요