Skip to content
Sarj Code Standards

no-dangerously-allow-svg

Require an explicit hardening policy for Next Image SVG delivery

noDangerouslyAllowSvg Rule source Tests Catalog JSON

Why

SVG can contain scripts and other active content. This organizational rule requires a recognized explicit script-blocking sandbox CSP when SVG delivery is enabled, with attachment disposition. It does not establish that framework defaults are missing or that a reported configuration is exploitable.

Fix

Disable dangerouslyAllowSVG, or configure an explicit literal image contentSecurityPolicy such as script-src 'none'; sandbox; and keep attachment disposition. Verify effective headers and defaults against the application's pinned Next version.

Examples

Before — flagged SVG opt-in requires explicit hardening under this policy
next.config.mjs
export default { images: { dangerouslyAllowSVG: true } };
After — preferred Keep active SVG delivery disabled
next.config.mjs
export default { images: { dangerouslyAllowSVG: false } };
Before — flagged A later duplicate cannot replace the effective policy
next.config.mjs
export default {
  images: {
    dangerouslyAllowSVG: true,
    contentDispositionType: "attachment",
    contentSecurityPolicy: "script-src 'unsafe-inline'; script-src 'none'; sandbox;",
  },
};
After — preferred Allow SVG delivery with explicit hardening
next.config.mjs
export default {
  images: {
    dangerouslyAllowSVG: true,
    contentDispositionType: "attachment",
    contentSecurityPolicy: "script-src 'none'; sandbox;",
  },
};

References