Support SVG activity assets

[elijaholmos]

As a developer, I would like to see SVG (.svg) added to the list of image formats.
As a developer, I would like to be able to upload SVG files as Rich Presence Activity Assets.
As a developer, I would like to be able to use external SVG images via media proxy.

[advaith1]

arbitrary SVGs cannot be displayed because they can include scripts and other things, which is why Discord doesn't render them in messages or anywhere else

[ooliver1]

Is it impossible to include a filter against "scripts and stuff"?

[PlavorSeol]

As I said above, just the existence of JavaScript in SVG should not really a problem, as scripts in it should not be able to be run unexpectedly (XSS) if you use it properly. If they are, it means that you set it up incorrectly, or you did it on purpose.

If Discord will allow SVGs for preview in channels, or for RPC activity assets so they can be displayed in users' profiles, they will embed them in img tags, just like they do for GIFs, JPGs, PNGs, or any other image formats. An img tag NEVER, EVER run JavaScript at all. Even if SVG file is specified in src attribute, a browser will simply ignore any script tags in it, resulting in JavaScript in it will never get run. Indeed there are other ways to display SVG if Discord chooses, like using iframe or even directly inserting SVG inline, but Discord should just never go in those ways. Of course, sandbox attribute for iframe can be used to block JavaScript from framed SVG, but simply using img tag is much safer than using iframe at all.

Direct viewing of SVG on cdn.discordapp.com can be concern, but that's what CSP is for. cdn.discordapp.com is explicitly untrusted zone, therefore IMO Discord should emit stricter CSP header on cdn.discordapp.com domain anyway, regardless of whether they will allow SVG rendering or not, if not done already, to improve security. Also cdn.discordapp.com is completely separated domain from clients (((canary|ptb)\.)?discord\.com). Being on separate domain itself should be double-layered protection if used in conjunction with CSP, thanks to JavaScript's same origin policy.

[ooliver1]

As I said above, just the existence of JavaScript in SVG should not really a problem, as scripts in it should not be able to be run unexpectedly (XSS) if you use it properly. If they are, it means that you set it up incorrectly, or you did it on purpose.
...

I was replying to Advaith

[PlavorSeol]

So what?

[SkyfallWasTaken]

Alternatively, you could go the Cloudflare route and just use an HTML sanitizer on the SVG file