10up / safe-svg

Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
https://wordpress.org/plugins/safe-svg/
GNU General Public License v2.0
263 stars 31 forks source link

SVGs have a 10mb size Limit #178

Open darylldoyle opened 5 months ago

darylldoyle commented 5 months ago

Describe the bug

We received a report in https://wordpress.org/support/topic/file-couldnt-be-sanitized-error/ stating that certain files couldn't be uploaded. After investigating the issue, we discovered that files larger than 10mb were being rejected due to the DOMDocument limit. We found a solution in version 0.18.0 of enshrined/svg-sanitize that allows us to bypass this limit using $this->sanitizer->setAllowHugeFiles( true );.

However, this solution disables the max recursion limits within the XML parser. As it is unlikely that users will regularly upload SVG files larger than 10mb, I suggest adding this option to the settings instead. When enabled, it sets setAllowHugeFiles() to true, allowing users who need to upload large files to do so without affecting everyone else.

Steps to Reproduce

  1. Install plugin.
  2. Try to upload an SVG that's larger than 10mb.
  3. See issue.

Code of Conduct