---
title: "Turn SVG uploads into plain images and · Agent Wranglers"
url: https://agentwranglers.se/playbook/files-and-media/uploads/svg-and-html-uploads
id: MED-39
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1065
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn SVG uploads into plain images and refuse HTML

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Uploads](https://agentwranglers.se/playbook/files-and-media/uploads.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: MED-39
- Level: Recommended
- Chapter: [Uploads](https://agentwranglers.se/playbook/files-and-media/uploads.md)
- Rule: Leave HTML, XHTML, XML and SVG off every upload kind that other people view. Where people must upload a vector logo, convert the SVG to PNG on the server and serve only the PNG.
- Check: Upload `logo.svg` holding `<script>` and `onload=` to the test copy. The stored file is a PNG, or an SVG with no script, handler or external reference. Upload `page.html` renamed to `photo.jpg`, and it is refused with 415.
- How: An SVG file is a document, not a picture. It can hold scripts, event handlers, links to other files and external entities. A browser that opens it directly runs all of that. An HTML upload is a whole web page under your name, which also makes it a ready phishing page. Converting to PNG in a sandbox, as [Run media tools in a sandbox with no network](https://agentwranglers.se/playbook/files-and-media/video-and-audio/media-tool-sandbox.md) says, drops every script. If the SVG itself must be kept, clean it with an SVG allowlist sanitiser. Serve it only from the domain in [Serve user files from their own domain](https://agentwranglers.se/playbook/files-and-media/uploads/user-content-domain.md). Detect the type from the bytes, not the name or the declared type.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import sharp from 'sharp';
import { fileTypeFromBuffer } from 'file-type';

const LOGO_WIDTH = 512;
const VIEWABLE_TYPES = new Set(['image/png', 'image/jpeg', 'image/webp']);

export async function acceptLogo(bytes) {
  const detected = await fileTypeFromBuffer(bytes);
  if (detected?.mime === 'application/xml' || bytes.subarray(0, 512).toString().includes('<svg')) {
    return sharp(bytes, { limitInputPixels: 25_000_000 }).resize(LOGO_WIDTH).png().toBuffer();
  }
  if (!VIEWABLE_TYPES.has(detected?.mime)) throw new UnsupportedMediaType(detected?.mime);
  return bytes;
}
```

### Python example

```python
import cairosvg
import magic

LOGO_WIDTH = 512
VIEWABLE_TYPES = {"image/png", "image/jpeg", "image/webp"}

def accept_logo(data: bytes) -> bytes:
    detected = magic.from_buffer(data, mime=True)
    if detected == "image/svg+xml":
        return cairosvg.svg2png(bytestring=data, output_width=LOGO_WIDTH, unsafe=False)
    if detected not in VIEWABLE_TYPES:
        raise UnsupportedMediaType(detected)
    return data
```

## Sources

- [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
- [CWE-79 Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)

## Related rules

- MED-14 [Run media tools in a sandbox with no network](https://agentwranglers.se/playbook/files-and-media/video-and-audio/media-tool-sandbox.md) in Files and media
- MED-3 [Serve user files from their own domain](https://agentwranglers.se/playbook/files-and-media/uploads/user-content-domain.md) in Files and media

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/files-and-media/uploads/svg-and-html-uploads">Agent Wranglers files and media playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Serve user files from their own domain](https://agentwranglers.se/playbook/files-and-media/uploads/user-content-domain.md)
- Next: [Store files under keys you make and clean the names you show](https://agentwranglers.se/playbook/files-and-media/uploads/safe-file-names.md)
- [Uploads](https://agentwranglers.se/playbook/files-and-media/uploads.md)