Problem/Motivation

When SVG is included in the allowed file extensions, uploads of SVG files fail silently with "not a valid image" because FilePondUploadHandler::validateImageContent() calls getimagesize() on all files with an image/* MIME type.

SVG files have the MIME type image/svg+xml, so they enter the image validation path. However, getimagesize() only works with raster image formats (JPEG, PNG, GIF, etc.) and returns FALSE for SVG files (which are XML-based vector graphics). This causes the upload to be rejected.

The check occurs in two places:

  1. handleUpload() — validates after writing to temp storage
  2. finalizeUpload() — validates again before creating the file entity

Steps to reproduce

  1. Configure a media type with an image source field that allows SVG extensions.
  2. Add svg to the allowed file extensions in FilePond settings (or ensure the media type's field settings include it).
  3. Open the Media Library and attempt to upload an SVG file.
  4. The upload fails — no media entity is created and no user-facing error is displayed.
  5. The server returns a 415 response with "Invalid image: not a valid image".

Proposed resolution

Skip getimagesize() validation for SVG files. SVGs should be validated as XML rather than raster images. The check in validateImageContent() should return TRUE early when the detected MIME type is image/svg+xml:

Additionally, the str_starts_with($mimeType, 'image/') gate in finalizeUpload() should also exclude SVGs from the getimagesize()-based dimension capture, since SVG dimensions are defined in the XML attributes and not available via getimagesize().

Remaining tasks

  • Update validateImageContent() to skip getimagesize() for SVG files.
  • Update finalizeUpload() to skip dimension capture for SVGs.
  • Optionally add basic SVG XML validation (well-formed XML, contains <svg> root element).
  • Add test coverage for SVG uploads.

User interface changes

None.

API changes

None.

Data model changes

None.

Issue fork filepond-3601096

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

jaydee1818 created an issue. See original summary.

loze made their first commit to this issue’s fork.

jaydee1818’s picture

Status: Active » Needs review

loze changed the visibility of the branch 3601096-svg-uploads-fail to hidden.

loze’s picture

Version: 1.0.0-alpha4 » 1.0.x-dev
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

loze’s picture

thanks, this is fixed in the latest release.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.