From 178f592e871448ca7b66fd8ee68f07f38e690ee7 Mon Sep 17 00:00:00 2001
From: Ferdinand Thiessen <opensource@fthiessen.de>
Date: Wed, 15 Jul 2026 00:13:30 +0200
Subject: [PATCH] fix(preview): properly handle encoded content

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
---
 lib/private/Preview/SVG.php   | 40 ++++++++++++++++++++++++++----
 tests/lib/Preview/SVGTest.php | 46 +++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+), 5 deletions(-)

diff --git a/lib/private/Preview/SVG.php b/lib/private/Preview/SVG.php
index d9f7701f411c4..b09cf398f4887 100644
--- a/lib/private/Preview/SVG.php
+++ b/lib/private/Preview/SVG.php
@@ -25,15 +25,19 @@ public function getMimeType(): string {
 	public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
 		try {
 			$content = stream_get_contents($file->fopen('r'));
-			if (substr($content, 0, 5) !== '<?xml') {
-				$content = '<?xml version="1.0" encoding="UTF-8" standalone="no"?>' . $content;
+			if ($content === false) {
+				return null;
 			}
-
-			// Do not parse SVG files with references
-			if (preg_match('/["\s](xlink:)?href\s*=/i', $content)) {
+			// check if the file can be processed by this provider
+			if (!$this->canBeProcessed($content)) {
 				return null;
 			}
 
+			$content = ltrim($content);
+			if (substr($content, 0, 5) !== '<?xml') {
+				$content = '<?xml version="1.0" encoding="UTF-8" standalone="no"?>' . $content;
+			}
+
 			$svg = new \Imagick();
 
 			$svg->pingImageBlob($content);
@@ -67,4 +71,30 @@ public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
 		}
 		return null;
 	}
+
+	/**
+	 * Check if the file can be processed by this provider,
+	 * meaning the SVG is safe to be processed and does not contain any external references.
+	 */
+	protected function canBeProcessed(string $content): bool {
+		// check for allowed encodings and convert if necessary
+		$encoding = mb_detect_encoding($content, ['UTF-8', 'ISO-2022-JP', 'ISO-8859-1'], true);
+		if ($encoding === false) {
+			return false;
+		} elseif ($encoding !== 'UTF-8') {
+			$content = mb_convert_encoding($content, 'UTF-8', $encoding);
+		}
+
+		// Strip all non-printable/control characters except newlines/tabs
+		$content = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $content);
+		if ($content === null) {
+			return false;
+		}
+
+		// check for any potential external reference (include custom namespace prefix)
+		if (preg_match('/["\s\']([a-z_][a-z0-9_.-]*:)?href\s*=/i', $content)) {
+			return false;
+		}
+		return true;
+	}
 }
diff --git a/tests/lib/Preview/SVGTest.php b/tests/lib/Preview/SVGTest.php
index 6a0e93e5f7942..35e7037403419 100644
--- a/tests/lib/Preview/SVGTest.php
+++ b/tests/lib/Preview/SVGTest.php
@@ -58,4 +58,50 @@ public function testGetThumbnailSVGHref(string $content): void {
 
 		self::assertNull($this->provider->getThumbnail($file, 512, 512));
 	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider('dataGetThumbnailSVGHrefNamespace')]
+	#[\PHPUnit\Framework\Attributes\RequiresPhpExtension('imagick')]
+	public function testGetThumbnailSvgHrefNamespace(string $namespace): void {
+		$handle = fopen('php://temp', 'w+');
+		fwrite($handle, '<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" xmlns:' . $namespace . '="http://www.w3.org/1999/xlink">
+  <image x="0" y="0" ' . $namespace . ':href="fxlogo.png" height="100" width="100" />
+</svg>');
+		rewind($handle);
+
+		$file = $this->createMock(File::class);
+		$file->method('fopen')
+			->willReturn($handle);
+
+		self::assertNull($this->provider->getThumbnail($file, 512, 512));
+	}
+
+	public static function dataGetThumbnailSVGHrefNamespace(): array {
+		return [
+			['xlink'],
+			['foo'],
+			['_foo'],
+			['fo_12'],
+			['foo-bar'],
+			['Fo_B1-ar'],
+		];
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider('dataGetThumbnailSvgEncoded')]
+	#[\PHPUnit\Framework\Attributes\RequiresPhpExtension('imagick')]
+	public function testGetThumbnailSvgEncoded(string $content): void {
+		$handle = fopen('php://temp', 'w+');
+		fwrite($handle, $content);
+		rewind($handle);
+
+		$file = $this->createMock(File::class);
+		$file->method('fopen')
+			->willReturn($handle);
+		self::assertNull($this->provider->getThumbnail($file, 512, 512));
+	}
+
+	public static function dataGetThumbnailSvgEncoded(): array {
+		return [
+			'iso-2022-jp' => ["<?xml version=\"1.0\" encoding=\"ISO-2022-JP\"?>\n<svg width=\"700\" height=\"700\" xmlns=\"http://www.w3.org/2000/svg\">\n<i\x1b(Bmage width=\"700\" height=\"700\" h\x1b(Bref=\"text:/proc/cpuinfo\" />\n</svg>"],
+		];
+	}
 }