Redmine

hello, just a question, is this a good idea? SVGs are know in the security community as extremely dangerous as they can contain embedded code for remote execution etc. This would create another layer of potential attack for redmine installations.

Just a question.
Some basic information about the issue from CloudFlares blog: https://www.cloudflare.com/en-gb/threat-intelligence/research/report/svgs-the-hackers-canvas/

Michael M wrote in #note-3:

hello, just a question, is this a good idea? SVGs are know in the security community as extremely dangerous as they can contain embedded code for remote execution etc. This would create another layer of potential attack for redmine installations.

Thank you for raising this point.

However, in this case, Redmine uses only a bundled SVG image that is included in the official Redmine distribution. This image is trusted and does not contain scripts or any malicious contents, as shown in the patch file 0001-Replace-loading-and-hourglass-icons-with-SVG-version.patch.

Therefore, I believe that this series of patches does not pose the kind of risk described in the article.