# Supporting SVG image upload

**URL:** <https://discourse.haskell.org/t/supporting-svg-image-upload/10144>\
**Category:** Site Feedback\
**Created:** [August 10, 2024, 8:41pm UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144 "2024-08-10T20:41:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhendric](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/rhendric/32/2689_2.png) [@rhendric](https://discourse.haskell.org/u/rhendric)\
**Post date:** [August 10, 2024, 8:41pm UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144/1 "2024-08-10T20:41:09Z")

</div>

The list of supported file types for image uploading appears not to contain any vector formats. Can SVG be added?

(I’d like to stop relying on third-party services which may not work for everyone when making posts like [http://discourse.haskell.org/t/the-quest-to-completely-eradicate-string-awkwardness/10111/70](http://discourse.haskell.org/t/the-quest-to-completely-eradicate-string-awkwardness/10111/70).)

---

<div class="post-metadata">

**Author:** ![f-a](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/f-a/32/2740_2.png) [@f-a](https://discourse.haskell.org/u/f-a)\
**Post date:** [August 11, 2024, 6:14am UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144/2 "2024-08-11T06:14:11Z")

</div>

I will investigate, I suspect they do not support it (or it is turned off by default) as they don’t want to deal with the [additional security workload](https://www.fortinet.com/blog/threat-research/scalable-vector-graphics-attack-surface-anatomy).

---

<div class="post-metadata">

**Author:** ![mpilgrem](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/mpilgrem/32/2529_2.png) [@mpilgrem](https://discourse.haskell.org/u/mpilgrem)\
**Post date:** [July 5, 2025, 7:57pm UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144/3 "2025-07-05T19:57:19Z")

</div>

Did you complete your investigation? Was it security-related, as you suspected? I think, but I am not certain, that Discourse applies a sanitizer to SVG files when their upload is allowed.

---

<div class="post-metadata">

**Author:** ![f-a](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/f-a/32/2740_2.png) [@f-a](https://discourse.haskell.org/u/f-a)\
**Post date:** [July 10, 2025, 1:19pm UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144/4 "2025-07-10T13:19:30Z")

</div>

[There is a sanitiser](https://github.com/discourse/discourse/blob/ce686a008f97708099efbe9969d1a83f8b8950cf/lib/upload_creator.rb#L9-L13), but the extension has to whitelisted by an admin.

I will talk to them.

---

<div class="post-metadata">

**Author:** ![f-a](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/f-a/32/2740_2.png) [@f-a](https://discourse.haskell.org/u/f-a)\
**Post date:** [July 10, 2025, 2:26pm UTC](https://discourse.haskell.org/t/supporting-svg-image-upload/10144/5 "2025-07-10T14:26:01Z")

</div>

Test:

![Logo_of_the_Haskell_programming_language](https://us1.discourse-cdn.com/flex002/uploads/haskell/original/2X/b/bdd9ee2b86ac172d5b2642f530b21da52608dc31.svg)

This seems to work!