Blocked animation?

Hi @hasse2016,

<animate> is indeed classed as a security threat. In terms of being uploaded by an admin, this is pretty subjective as an admin user may know loads about SVG security or they may not know it’s an issue at all. Therefore we sanitise for all users the same.

If you’d like to see more about the animate element and why it’s an issue, there are a few examples available here: https://html5sec.org/#89

Mario Heiderich talks about it in this paper: https://www.owasp.org/images/0/03/Mario_Heiderich_OWASP_Sweden_The_image_that_called_me.pdf

I also briefly covered it in my WordCamp London talk: https://wordpress.tv/2019/01/22/daryll-doyle-securing-svg-uploads-in-wordpress/

I hope that answers some of your questions.

If you’d like to allow the element through the sanitiser, it’s worth taking a look at the FAQs for the svg_allowed_attributes and svg_allowed_tags filters as they’ll allow you to modify the whitelist on your site.

Cheers,
Daryll