fleet/changes/add-svg-support-custom-logos at 6bfbc798de0bfeb906aac08b7d4783ec7582dbbd - fleet - Gitea: Git with a cup of tea

Discharge7443/fleet

Files

T

Nico fd3ec5a9aa Add SVG support for custom organization logos (#44748 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Follow-up to #44390 (BE/FE) and #44550 (GitOps).
Parent story #39016.

## Summary

Accepts `.svg` for organization logo uploads in addition to
PNG/JPEG/WebP, with strict server-side validation since SVGs can carry
scripts.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/318d320e-ff78-41fe-ad3a-55d6dace8dc0



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Organization logos now accept SVG in addition to PNG, JPEG, and WebP.
  * Stored SVG logos are re-validated when served.

* **Security**
* Server applies strict SVG sanitization to block scripts, unsafe
elements, event handlers, and unsafe URL schemes.
* SVG logo responses include headers to prevent content-type sniffing
and restrict execution.

* **Tests**
* Added tests covering SVG detection, validation, allowed/rejected
cases, and serving behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-05-06 15:20:53 +02:00

2 lines

136 B

Plaintext

Raw Blame History

* Added SVG support for custom organization logos, with strict server-side sanitization to reject scripts and other unsafe SVG content.