image/svg MIME breaks browser rendering of SVG files

[PhoenixPeca]

• Laravel Version: 6.9.0
• PHP Version: 7.4

Description:

Hi, I believe there's an issue with PR #30204

Apparently, browsers need the svg files to have the Content-Type: image/svg+xml to render them.

Browsers does not render the "svg" images when we set the Content-Type: image/svg in source links of <img src="..."> and css url('...') as shown in the image:

Opening the file directly downloads it immediately.

Steps To Reproduce:

1. This happens when I used the laravel response method in a route:

return response()->file('/path/logo.svg');

2. Then use that route as the source link of <img src="..."> or css background-image: url('...');

---

As mentioned in your description, this MIME only triggers when <?xml ... ?> does not exist.

So i end up with two choices to resolve locally:

1. I edit each SVG file in my project and add the xml declaration.
2. I override the content-type header and replace it with Content-Type: image/svg+xml

---

I recommend that this PR is reverted and set it back to image/svg+xml.. Afterall, SVG files are all based on xml.. I believe there's no need to differentiate.

Update:
Issue may not be caused by PR #30204

[GrahamCampbell]

Reverting that PR won't fix your issue?

[PhoenixPeca]

Hi @GrahamCampbell , I just did a quick debug.. Sorry, my mistake... Apparently, my issue did not get resolved when I reverted the PR. Maybe this issue is not directly related with the PR.. can you help identify?

Cheers!

[driesvints]

Hi there,

Thanks for reporting but it looks like this is a question which can be asked on a support channel. Please only use this issue tracker for reporting bugs with the library itself. If you have a question on how to use functionality provided by this repo you can try one of the following channels:

• Laracasts Forums
• Laravel.io Forums
• StackOverflow
• Discord
• Larachat
• IRC

However, this issue will not be locked and everyone is still free to discuss solutions to your problem!

Thanks.

[lao9s]

Hi @PhoenixPeca,
SVG with JavaScript is a subset of XSS vulnerabilities.
More details you ca see here