Problem/Motivation
When SVG is included in the allowed file extensions, uploads of SVG files fail silently with "not a valid image" because FilePondUploadHandler::validateImageContent() calls getimagesize() on all files with an image/* MIME type.
SVG files have the MIME type image/svg+xml, so they enter the image validation path. However, getimagesize() only works with raster image formats (JPEG, PNG, GIF, etc.) and returns FALSE for SVG files (which are XML-based vector graphics). This causes the upload to be rejected.
The check occurs in two places:
handleUpload()— validates after writing to temp storagefinalizeUpload()— validates again before creating the file entity
Steps to reproduce
- Configure a media type with an image source field that allows SVG extensions.
- Add
svgto the allowed file extensions in FilePond settings (or ensure the media type's field settings include it). - Open the Media Library and attempt to upload an SVG file.
- The upload fails — no media entity is created and no user-facing error is displayed.
- The server returns a 415 response with "Invalid image: not a valid image".
Proposed resolution
Skip getimagesize() validation for SVG files. SVGs should be validated as XML rather than raster images. The check in validateImageContent() should return TRUE early when the detected MIME type is image/svg+xml:
Additionally, the str_starts_with($mimeType, 'image/') gate in finalizeUpload() should also exclude SVGs from the getimagesize()-based dimension capture, since SVG dimensions are defined in the XML attributes and not available via getimagesize().
Remaining tasks
- Update
validateImageContent()to skipgetimagesize()for SVG files. - Update
finalizeUpload()to skip dimension capture for SVGs. - Optionally add basic SVG XML validation (well-formed XML, contains
<svg>root element). - Add test coverage for SVG uploads.
User interface changes
None.
API changes
None.
Data model changes
None.
Issue fork filepond-3601096
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 1.0.x
changes, plain diff MR !1
- 3601096-svg-uploads-fail
compare
Comments
Comment #4
jaydee1818 commentedComment #6
loze commentedComment #8
loze commentedthanks, this is fixed in the latest release.