[11.x] Backport of Prevent XSS vulnerabilities by excluding SVGs by default in image validation

[SanderMuller]

Backport of #54331 to 11.x

This patch introduces the security enhancement from #54331, preventing XSS vulnerabilities by excluding SVG files from ImageFile validation by default.

To maintain backward compatibility, SVG files are still allowed by default in Laravel 11.x. However, a new static method, ImageFile::allowSvg(allowByDefault: false), is introduced. This method can be used to disable SVG validation globally, aligning the behavior with Laravel 12.x.

---

Usage

To enforce the new behavior globally, add the following to your AppServiceProvider:

use Illuminate\Validation\Rules\ImageFile;

public function boot()
{
    ImageFile::allowSvg(allowByDefault: false);
}

Benefits

• Enhanced Security: Mitigates potential XSS vulnerabilities by providing an option to exclude SVG files from image validation.
• Backward Compatibility: The change preserves the default behavior in Laravel 11.x, allowing SVGs unless explicitly disabled.
• Upgrade Readiness: Introduces an optional configuration to align with Laravel 12.x behavior, simplifying future upgrades.
• Global Configuration: Provides a straightforward method to enforce stricter validation across your application with a single setting.

[crynobone]

why not make allowSvgByDefault(bool) and disallowSvgByDefault(bool)

[SanderMuller]

Oversight, will add!

[taylorotwell]

Because users have to literally inline render the user provided SVGs, I'm not going to backport this.