How to safely store SVGs in a database and deliver as downloads?

Viewed 46

I'm building a WordPress website that will serve SVG files for download. Since WP doesn't natively support uploading SVG for security reasons, I've opted for a custom text field where I copy-paste the SVG code, save it into the database, then pull that field data to display the SVG on the front-end of the site.

This JS then delivers the inline SVG to users who wish to download it:

$("#download-link").click((function() {
        var e = $(this)
          , t = $(".inline-svg").html()
          , i = new Blob([t],{
            type: "image/svg+xml;charset=utf-8"
        })
          , o = URL.createObjectURL(i);
        e.attr("href", o)
    }
))

My question is: is this a safe method for storing and delivering SVGs or am I overlooking other security concerns? Is this better/worse than just modifying WP in functions.php to allow upload of actual SVG files? FWIW, I will be the only creator of the SVGs as well as the only Admin of the site.

0 Answers
Related