PowerToys-Explorer Preview cannot handle a certain xml property

[gammeter]

Microsoft PowerToys version

0.41.4

Running as admin

• [X] Yes

Area(s) with issue?

SVG Preview

Steps to reproduce

Select a SVG file which contains an xmlns:svg property, for example this one (I packed it into a zip because SVG files are not supported as attachements): Mapper_vereinfacht.zip

note: if you remove xmlns:svg="http://www.w3.org/2000/svg" the preview works fine.

✔️ Expected Behavior

The SVG image should be rendered in the preview pane. For the file above:

❌ Actual Behavior

The preview pane shows a wrong preview. For the file above:

Other Software

No response

[dedavis6797]

@jaimecbernardo / @DHowett is this even something file explorer add-ons can support? I'm not sure if they can run http requests.

[jaimecbernardo]

From what I see, SVG Preview Handler is using a Windows Forms WebBrowser Control, with features removed to avoid exploits: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa770041(v=vs.85)?redirectedfrom=MSDN#controlling-download-and-execution

This includes avoiding internet access. Allowing it would likely open this up to vulnerabilities.

Here's an idea of the current parameters:

    result = Convert.ToInt32(
        WebBrowserDownloadControlFlags.DLIMAGES |
        WebBrowserDownloadControlFlags.PRAGMA_NO_CACHE |
        WebBrowserDownloadControlFlags.FORCEOFFLINE |
        WebBrowserDownloadControlFlags.NO_CLIENTPULL |
        WebBrowserDownloadControlFlags.NO_SCRIPTS |
        WebBrowserDownloadControlFlags.NO_JAVA |
        WebBrowserDownloadControlFlags.NO_FRAMEDOWNLOAD |
        WebBrowserDownloadControlFlags.NOFRAMES |
        WebBrowserDownloadControlFlags.NO_DLACTIVEXCTLS |
        WebBrowserDownloadControlFlags.NO_RUNACTIVEXCTLS |
        WebBrowserDownloadControlFlags.NO_BEHAVIORS |
        WebBrowserDownloadControlFlags.SILENT, CultureInfo.InvariantCulture);