The avatar that ran code
One user's profile picture is a small grey circle. Everyone who opened it in a new tab was signed out, and their accounts were used elsewhere.
This answers: Can an uploaded SVG image run JavaScript? No coding needed. 3 quick decisions.
- Who may see what
- Keeping data safe
Checking your access…
Can an uploaded SVG image run JavaScript?
Yes. SVG is a document format that can contain scripts, and when an SVG is opened directly from your domain the script runs like one of your pages. Accept only real raster images, check the file's actual content rather than its name, convert uploads to WebP or PNG, and serve user files from a separate storage domain.
Breaks at File storage: SVG served from your own domain
Why AI tools write this bug
Upload code from AI tools usually checks the file extension or the browser's content type, both of which the uploader controls.
How to fix it
- Reject SVG for user uploads, or it strictly.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Is Supabase Storage safe for user uploads?
- It serves files from its own domain, which keeps scripts away from your app's sign-in. Still convert images and limit file types.