commit c93d71c545bd0e996c12365820570287509af364
author Lars Clausen <larsrc@google.com> Tue Jan 08 15:43:08 2019 +0100
committer Lars Clausen <larsrc@google.com> Tue Jan 08 15:49:03 2019 +0100
tree a9db7ca0153b730728432a57e4a0cd09ff7d68f4
parent 3787673a46358d1d4a86423221bb6dd228fe2c6b

Add MIME type for favicons to list of allowed image types.

Also added a comment with a warning about SVG

Change-Id: I226dfddbb19a0d8f2a8ea45748e6db7eff2fe6d7

polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js

diff --git a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
index bf543e5..11bea8c 100644
--- a/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
+++ b/polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder-image.js
@@ -20,7 +20,9 @@
   // Prevent redefinition.
   if (window.GrDiffBuilderImage) { return; }
 
-  const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|jpeg|jpg|png|tiff|webp)$/;
+  // MIME types for images we allow showing. Do not include SVG, it can contain
+  // arbitrary JavaScript.
+  const IMAGE_MIME_PATTERN = /^image\/(bmp|gif|x-icon|jpeg|jpg|png|tiff|webp)$/;
 
   function GrDiffBuilderImage(diff, prefs, outputEl, baseImage, revisionImage) {
     GrDiffBuilderSideBySide.call(this, diff, prefs, outputEl, []);