[security] Block SVG images?

[spoenemann]

See https://code.visualstudio.com/api/working-with-extensions/publishing-extension#publishing-extensions

[marcdumais-work]

Sounds like a good idea: https://blog.online-convert.com/svg-file-and-its-danger/

[netomi]

https://code.visualstudio.com/updates/v1_14#_constraints-for-rendering-svg-images

[netomi]

#1766 added support for specifying a list of blocked icon formats (svg being the default).

[RokeJulianLockhart]

@netomi, why have SVG as a default entrant? I ask per meta.discourse.org/t/212333/20, which appears to indicate that other, massive platforms, cope with user-uploaded SVGs well.

[netomi]

as open-vsx is basically a clone of the VSC marketplace, it is sensible to use similar validation rules. user-controlled svg images are a security issue unless you handle them very carefully. Virtually no extension uploaded to open-vsx.org uses svg images, but we want to enforce that at publication time.

In the future we might wanna support svg images, but for now there is absolutely no need imho.