Reply to thread

I think the root of it is that XF's image proxy doesn't support SVG images (it supports GIF, JPG, PNG, ICO and WEBP).  I assume it's intentional that SVG isn't supported by the image proxy because an SVG image can have embedded JavaScript that executes inside the image itself.  You could get some really malicious stuff happening by allowing users to execute JavaScript they wrote and then stuck in an image.  That image then is run on the host domain (since the proxy image is coming from the XF site).  You know... doing things like inserting ads to the site, stealing login credentials of anyone that viewed the image, etc.

The only way to realistically do it would go down a road of trying to whitelist certain allowed SVG tags/attributes inside the image itself and hope you didn't forget something.  Would be like trying to universally sanitize a webpage and remove all the different ways JavaScript could be on that page.