From c93d71c545bd0e996c12365820570287509af364 Mon Sep 17 00:00:00 2001 From: Lars Clausen Date: Tue, 8 Jan 2019 15:43:08 +0100 Subject: [PATCH] Add MIME type for favicons to list of allowed image types. Also added a comment with a warning about SVG Change-Id: I226dfddbb19a0d8f2a8ea45748e6db7eff2fe6d7 --- .../elements/diff/gr-diff-builder/gr-diff-builder-image.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js index bf543e53f5..11bea8c820 100644 --- a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js +++ b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js @@ -20,7 +20,9 @@ // Prevent redefinition. if (window.GrDiffBuilderImage) { return; } - const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|jpeg|jpg|png|tiff|webp)$/; + // MIME types for images we allow showing. Do not include SVG, it can contain + // arbitrary JavaScript. + const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|x-icon|jpeg|jpg|png|tiff|webp)$/; function GrDiffBuilderImage(diff, prefs, outputEl, baseImage, revisionImage) { GrDiffBuilderSideBySide.call(this, diff, prefs, outputEl, []);