外掛標籤
開發者團隊
原文外掛簡介
WordPress does not support SVG uploads natively — and naive SVG plugins are a well-known attack surface. SVG files are XML documents that can carry XSS payloads, XXE attacks, external resource injection, and embedded HTML. CodePros SVG Secure Support adds safe, production-ready SVG uploads through a layered defense pipeline.
Security Pipeline
Every uploaded SVG passes through five sequential checks before it is accepted:
Extension check — Blocks double-extension filenames (e.g. payload.php.svg) and enforces .svg only.
MIME check — Verifies actual file bytes return image/svg+xml via finfo; confirms
After validation, the file is sanitized:
DOM sanitization via the battle-tested enshrined/svg-sanitize library with custom tag and attribute whitelists.
Remote reference stripping — all external URLs are removed.
Final string-level regex scan for javascript:, 延伸相關外掛
