SVG images can contain JavaScript

The upload handler checks that the content type starts with "image/", but this check includes the image/svg+xml content type, so the following image is accepted:

There is a discussion on Hacker News, but feel free to comment here as well.

hackernews

@derp.foo

This community serves to share top posts on Hacker News with the wider fediverse.

Rules

Keep it legal
Keep it civil and SFW
Keep it safe for members of marginalised groups

go to feed...

hackernews

@derp.foo

This community serves to share top posts on Hacker News with the wider fediverse.

Rules

Keep it legal
Keep it civil and SFW
Keep it safe for members of marginalised groups

go to feed...