Logo SVG format - logo not showing in most of browsers

Long story short, Magento used to support SVG for logo formats. However, svg files can allow for code injections. Therefore the option was removed in the interest of security.

APPSEC-1673: Stored xss using svg images in Favicon: A Magento administrator with limited privileges can add new SVG images that contain injected code. - [Ref 1]

The danger of an SVG file comes from the fact that it’s an XML that can have embedded CSS and JavaScript. The web browser will automatically run any JavaScript embedded in an SVG file. Therefore, if the script contains malicious code, it will place the user’s computer at risk. - [Ref 2]

References:

1 Like