(allura) 02/06: [#8619] block SVG entirely, keep MathML

[br...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch db/8619
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 17f1a88131e015865354f90adc9c3d5a605a148d
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Tue Aug 25 16:31:25 2026 -0400

    [#8619] block SVG entirely, keep MathML
    
    Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
    Claude-Session: https://claude.ai/code/session_018KZ3wfWGSAzjfQj3neMfG3
---
 Allura/allura/lib/utils.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Allura/allura/lib/utils.py b/Allura/allura/lib/utils.py
index 58fee1701..97d9e5321 100644
--- a/Allura/allura/lib/utils.py
+++ b/Allura/allura/lib/utils.py
@@ -572,7 +572,13 @@ def __init__(self, *args, **kwargs):
         _extra_allowed_elements = {
             (ns_html, 'summary'),
         }
-        self.allowed_elements = (set(html5lib.filters.sanitizer.allowed_elements) | _extra_allowed_elements) - _form_elements
+        self.allowed_elements = (
+            (set(html5lib.filters.sanitizer.allowed_elements) | _extra_allowed_elements)
+            - _form_elements
+        )
+        # SVG is not worth the attack surface, so block SVG entirely
+        ns_svg = html5lib.constants.namespaces['svg']
+        self.allowed_elements = {el for el in self.allowed_elements if el[0] != ns_svg}
 
         # srcset is used in our own project_list/project_summary widgets
         # which are used as macros so go through markdown