diff --git a/Dockerfile b/Dockerfile
index 70d59ffd7..4a3fd2bcc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,7 +21,7 @@ RUN set -xe \
&& apt-get install -y --no-install-recommends \
gettext build-essential \
libxml2-dev libxslt1-dev zlib1g-dev git \
- libjpeg-dev libcairo2-dev libffi-dev libssl-dev libxslt1.1 \
+ libjpeg-dev libffi-dev libssl-dev libxslt1.1 \
optipng postgresql zip \
# python
&& python -m venv /venv \
@@ -103,7 +103,7 @@ COPY --chown=kitsune:kitsune . .
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
- libcairo2 libxslt1.1 optipng postgresql && \
+ libxslt1.1 optipng postgresql && \
rm -rf /var/lib/apt/lists/*
RUN mkdir /app/media && chown kitsune:kitsune /app/media
diff --git a/kitsune/sumo/form_fields.py b/kitsune/sumo/form_fields.py
index 58383e808..21d56ec6a 100644
--- a/kitsune/sumo/form_fields.py
+++ b/kitsune/sumo/form_fields.py
@@ -1,6 +1,5 @@
from pathlib import Path
-from cairosvg import svg2svg
from django import forms
from django.contrib.auth.models import User
from django.core import validators
@@ -86,7 +85,7 @@ class MultiUsernameField(forms.Field):
class ImagePlusField(forms.ImageField):
"""
- Same as django.forms.ImageField but with support for SVG images as well.
+ Same as django.forms.ImageField but with support for trusted SVG images as well.
"""
default_validators = [
@@ -98,7 +97,7 @@ class ImagePlusField(forms.ImageField):
def to_python(self, data):
"""
Check that the file-upload field data contains an image that
- Pillow supports or a valid SVG image.
+ Pillow supports or an SVG image (assumed to be trusted).
"""
try:
return super().to_python(data)
@@ -108,38 +107,4 @@ class ImagePlusField(forms.ImageField):
):
raise
- def scrub(svg_as_bytes):
- """
- Accepts an SVG file as bytes and returns a safe version of that
- SVG file as bytes.
- """
- try:
- return svg2svg(bytestring=svg_as_bytes)
- except Exception as exc:
- # CairoSVG doesn't recognize it as an SVG image.
- msg = _("Invalid or unsupported SVG image: {reason}")
- raise ValidationError(
- msg.format(reason=str(exc)),
- code="invalid_svg_image",
- ) from exc
-
- if hasattr(data, "read"):
- # This is typically an instance of a sub-class of UploadedFile,
- # which shouldn't be closed, otherwise it will be deleted.
- data.seek(0)
- try:
- scrubbed = scrub(data.read())
- finally:
- # The read pointer is expected to point to the start of the file.
- data.seek(0)
- try:
- # Over-write the image with its scrubbed version.
- data.truncate()
- data.write(scrubbed)
- finally:
- # The read pointer is expected to point to the start of the file.
- data.seek(0)
- else:
- data["content"] = scrub(data["content"])
-
return data
diff --git a/kitsune/sumo/tests/test_form_fields.py b/kitsune/sumo/tests/test_form_fields.py
index 1393b4ed3..7d7fe507e 100644
--- a/kitsune/sumo/tests/test_form_fields.py
+++ b/kitsune/sumo/tests/test_form_fields.py
@@ -105,22 +105,6 @@ class ImagePlusFieldTestCases(TestCase):
data = self.get_uploaded_file("stuff.svg")
self.assertEqual(field.clean(data), data)
- def test_svg_image_with_unsafe_file(self):
- """Test for the case when the uploaded file is unsafe."""
- field = ImagePlusField()
- data = self.get_uploaded_file(
- "stuff.svg",
- content=b"""
- """,
- )
- self.assertEqual(field.clean(data), data)
- content = data.read()
- self.assertIn(b'