# 上传白色 SVG 标志会导致样式丢失并变为黑色

**URL:** <https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575>\
**Category:** Bug\
**Created:** [2019年二月7日 08:46 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575 "2019-02-07T08:46:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![viktorsmari](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/viktorsmari/32/130959_2.png) [@viktorsmari](https://meta.discourse.org/u/viktorsmari)\
**Post date:** [2019年二月7日 08:46 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/1 "2019-02-07T08:46:10Z")

</div>

I am uploading an SVG logo which has these styles included:

```plaintext
<style type="text/css">
.st0{fill:#FFFFFF;}
</style>

```

When I view the image after upload I don’t see this section, and the logo becomes black.

(The previous SVG logo was black, but I want it now to become white.)

I tried uploading another random image and that worked, then I tried again uploading the white image, and it again, becomes black.

Is the styles section being removed when uploading the SVG?

This is the forum: [https://forum.smartcitizen.me/](https://forum.smartcitizen.me/) and the logo **after** upload: [https://forum.smartcitizen.me/uploads/default/original/1X/83af5c7ecbd0eafe044b00537945b2ef4bdef1a2.svg](https://forum.smartcitizen.me/uploads/default/original/1X/83af5c7ecbd0eafe044b00537945b2ef4bdef1a2.svg)

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2019年二月7日 09:41 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/2 "2019-02-07T09:41:48Z")

</div>

It’s because we automatically remove `<style>` in SVGs for security reasons. Try inline styles instead.

* * *

Now that I think about it, it’s kinda pointless to block `<style>` tags but not inline styles…  
Maybe we should allow them as this has generated more support question than actual security issues?

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [2019年二月7日 10:20 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/3 "2019-02-07T10:20:38Z")

</div>

> <https://security.stackexchange.com/questions/11384/exploits-or-other-security-risks-with-svg-upload>

SVG recommendations:

- Disable all DTD processing, XInclude, XSL, XSI and entity resolution.
- SVG files can include JavaScript, so that has to be disabled

I don’t think `<style>` is dangerous and I can’t remember why we originally did this.. but the above _definitely_ should be checked.

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2019年二月7日 10:22 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/4 "2019-02-07T10:22:23Z")

</div>

> [@codinghorror](#):
>
> I don’t think `<style>` is dangerous and I can’t remember why we originally did this…

You can load external files in CSS, so you can do things like [track users](https://github.com/jbtronics/CrookedStyleSheets).  
But I don’t remember seeing any security issues though.

> [@codinghorror](#):
>
> but the above _definitely_ should be checked.

We only allow these SVG elements

> <https://github.com/discourse/discourse/blob/19386ec2ea8dacb5574e5218c672370e12c83723/lib/upload_creator.rb#L10-L13>

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2019年二月7日 11:09 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/5 "2019-02-07T11:09:46Z")

</div>

I’ve now allowed `<style>` elements in SVGs

[https://github.com/discourse/discourse/commit/c256121833008057f9f6834f9268aa77e0fc9ea2](https://github.com/discourse/discourse/commit/c256121833008057f9f6834f9268aa77e0fc9ea2)

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2019年二月7日 17:00 UTC](https://meta.discourse.org/t/uploading-a-white-svg-logo-gets-it-styles-removed-and-becomes-black/108575/6 "2019-02-07T17:00:00Z")

</div>

This topic was automatically closed after 5 hours. New replies are no longer allowed.