Svg thumbnails not showing embedded pictures

[6lv1-blr]

Microsoft PowerToys version

"v0.57.2"

Running as admin

• [X] Yes

Area(s) with issue?

SVG Preview, SVG Thumbnail

Steps to reproduce

a svg file like this is not showing the picture embedded as it's diplayed in Edge browser.

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="1024" height="768" viewBox="0 0 1024 768">
<image x="0.0" y="0.0" width="1024px" height="768px" xlink:href="ImageTest1024x768.jpg"/>
<line x1="100" y1="100" x2="150"  y2="200" stroke-width="6" stroke="#00FF00" />
</svg>

the modified svg like this works but cannot be move in another folder because of absolute path

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="1024" height="768" viewBox="0 0 1024 768">
<image x="0.0" y="0.0" width="1024px" height="768px" xlink:href="C:/Users/Public/ImageTest1024x768.jpg"/>
<line x1="100" y1="100" x2="150"  y2="200" stroke-width="6" stroke="#00FF00" />
</svg>

not link to this but same error displayed in panel preview : https://github.com/microsoft/PowerToys/issues/2204

✔️ Expected Behavior

the message "Some elements have been blocked to help prevent the sender from identifying your computer. Open this item to view all elements." still appears in preview panel, I think I understand it's linked to http://www.w3.org which has its request blocked

❌ Actual Behavior

Message Appears "Some elements have been blocked to help prevent the sender from identifying your computer. Open this item to view all elements." in preview panel but also for the working file

Other Software

No response

[6lv1-blr]

in src/modules/previewpane/SvgThumbnailProvider/SvgThumbnailProvider.cs :

line 109 browser.DocumentText = wrappedContent; https://github.com/microsoft/PowerToys/blob/f778d010e57e6882d952f58d058e7dd213e0fdbe/src/modules/previewpane/SvgThumbnailProvider/SvgThumbnailProvider.cs#L109

is probably in a temporary folder, so the image from the real directory doesn't exist in that context

[callmeTayyy]

I don't think this is a good idea. To render a linked image on the thumbnail requires access to a secondary file on disk, and would cause other problems:

• the link could be pointing to a different folder
• the link could be using relative paths
• it could cause confusion since the image is not embedded in the .svg itself
• it could raise privacy and security concerns

I suggest that you embed the image file inside the svg.

[6lv1-blr]

I don't think this is a good idea. To render a linked image on the thumbnail requires access to a secondary file on disk, and would cause other problems:

* the link could be pointing to a different folder

* the link could be using relative paths

* it could cause confusion since the image is not embedded in the `.svg` itself

* it could raise privacy and security concerns

I suggest that you embed the image file inside the svg.

Embedding the file is the solution for powertoys, but the files are like this, and render correctly in egde and firefox. I expect a thumbnail to be a preview of a standard, not adapt the files to make one program working.

And if you try my examples, you will see that access to another file is already done if you specify the full path

thanks

[jaimecbernardo]

Image tags are supposed to be blocked, the idea here being that we don't support it. Perhaps in the future.

[6lv1-blr]

Image tags are supposed to be blocked, the idea here being that we don't support it. Perhaps in the future.

If image tags "are supposed to be blocked" the issue is that is working with image with full path... so I don't know if it's a security issue ?