The SVG Image module in Drupal was generating simplexml_load_string() warnings when processing corrupted image files that contained HTML content instead of actual image data. This occurred because:
Corrupted Files: Image files with extensions like .png, .jpg, .svg actually contained HTML content (typically Cloudflare Access login pages or error responses)
No Content Validation: The SVG Image module attempted to parse all files as XML without validating the content first
XML Parser Errors: When simplexml_load_string() tried to parse HTML as XML, it generated parser warnings
Error Example:
Warning: simplexml_load_string(): Entity: line 16: parser error : xmlParseEntityRef: no name in svg_image_get_image_file_dimensions() (line 106 of modules/contrib/svg_image/svg_image.module)
During failed upload processes, files were being saved as images in conjunction with the module stage_file_proxy:
Network authentication redirected to login pages
Cloudflare Access returned HTML instead of image content
Error responses were saved with image file extensions
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 3549902_svg_image_fix_simplexml_warning.patch | 1.48 KB | fant0m |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
fant0m commentedAdds Content Validation
Checks if file content actually contains SVG markup ( Prevents processing of HTML files saved with SVG/image extensions
Implements Error Suppression
Uses libxml_use_internal_errors(TRUE) to suppress XML parser warnings
Adds libxml_clear_errors() to clean up after parsing attempts
Improves Error Handling
Validates simplexml_load_string() return value before using result
Provides graceful fallback when XML parsing fails
Adds Logging
Logs warnings about invalid SVG content for debugging purposes
Helps identify problematic files without breaking site functionality
Problem Solved
Before: XML parser warnings flood logs when encountering HTML files with image extensions
After: Graceful handling with proper validation and logging, no warnings generated
Comment #3
mably commentedCouldn't it be fixed by this other issue's MR ? #3350696: SVG is not valid or cannot be sanitized, return an error.
There is also a related MR that checks files on creation.
Comment #4
fant0m commentedThe previous patch is incorrect - it's missing proper diff prefixes (+) on some lines, specifically in the else block around line 36.
Comment #6
fant0m commentedComment #7
fant0m commentedHi @mably
I did check MR from the - "https://www.drupal.org/project/svg_image/issues/3350696"
Yes, the warning has gone, but it breaks image uploads on my D11 because it uses the deprecated hook_file_validate().
Comment #8
marcoliver@fant0m
You could maybe check https://www.drupal.org/project/svg_image/issues/3350696 again, because the deprecation was removed a while ago.
Marking this RTCB though, since it does what it sets out to do and in the end it's for the maintainers to decide which changes should go into the module anway.