Disable in-content SVG rendering

[nodiscc]

Can be considered for relaxing #231

[TriMoon]

Why would one want to do this??
The only reason i can think of is embedded javascript inside the SVG, but that can be blocked by other means eg Content-Policy and blocking addons like uMatrix.

AFAIK plain SVG is harmless.

[pyllyukko]

There has been vulnerabilities in SVG parsing, so I wouldn't consider it as harmless. It's about reducing attack surface.

I do realize, that this might break bunch of stuff as was also noted here. And we might need to revisit this setting.

If you check Firefox security advisories, there's a whole bunch of SVG related vulnerabilities.

[TriMoon]

Thanks i wasn't aware of that (fixed) exploit in svg... 👍

[nodiscc]

For reference there was at least one (fixed) severe security issue with SVG in Firefox: https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ (Firefox SVG Animation Remote Code Execution - Firefox 50.0.2, ESR 45.5.1)