Kuma: Magic is incorrectly using image/svg as MIME type for SVG files, preventing uploads of SVG files

[a2sheppy]

Magic or libmagic is incorrectly using image/svg as the MIME type for SVG uploads, rather than image/svg+xml, which is the only correct MIME type [1] (and the one we've always used in the past).

Normally, we keep SVG uploads disabled for security reasons since SVG can contain JavaScript code. However, we like to use it for diagrams and the like because they can be translated, and they are more efficient for that purpose in many cases. When we want to upload SVG, we go to the admin panel in Django and in the Constance panel, add "image/svg+xml" to the WIKI_ATTACHMENT_ALLOWED_TYPES string. Then we upload the file and restore the previous string to that preference.

This is no longer working; even with image/svg+xml listed in the preference, uploads fail with an error announcing that "Files of this type are not permitted." This should work, however.

This issue is blocking work on WebXR and potentially other documentation that requires the use of diagrams to explain things properly. Hopefully the fix is not complicated.

[1] https://www.iana.org/assignments/media-types/media-types.xhtml#image

[atopal]

Hey Sheppy, can you try image/svg instead? Looks like it's an issue in a library we are using.

[a2sheppy]

Using image/svg allows uploading but then the resulting file is not recognized by CKEditor or web browsers as a valid image file and will not render. The library needs to be fixed.

[a2sheppy]

@atopal ^

[peterbe]

How about this for a solution:

1) If the computed mimetype is image/svg we override and say it's image/svg+xml.
2) If you're a superuser or staff and the mimetype is image/svg+xml we skip the validation check and just allow it.

That worked for me in a quick hack. Now I was able to insert my SVG:

It's a bit convoluted but it certainly fixes the problem.

@escattone You looked into this but I see no comment from you. Perhaps you wrote your comment elsewhere.

[a2sheppy]

That works for me. It will be better than the current situation by far.

[peterbe]

There are 29 users with staff status.
If we go for this solution, I wouldn't mind removing the use of Constance and just switching to a plain environment variable for this.

[peterbe]

@escattone If you don't mind it, I can take a stab.

[escattone]

@peterbe I had spent some time last week looking into getting libmagic to return image/svg+xml rather than image/svg, but I couldn't see how to resolve that. It seems like a configuration bug, but I'm not sure. I like your proposed workaround, so please go ahead and take a stab, thanks!

[atopal]

Peter, if you are working on this, do we need to remove something from the current sprint to accommodate that?

[peterbe]

Peter, if you are working on this, do we need to remove something from the current sprint to accommodate that?

I'm ahead on my sprint stuff. Besides, this is easy to do.

[a2sheppy]

Be sure to check to make sure the SVG also renders when the page is presented to the user, both on the wiki and on the react site. I could see that being handled differently in different code paths. :)

Eagerly waiting for this one. I am starting to pile up SVGs to add to pages. :)

[peterbe]

Be sure to check to make sure the SVG also renders

Just to be clear; this is more of a note-to-self-and-other-writers, right?