Skip to content

Allow to use SVG for project and group avatars

Problem description

The issue requests support for SVG format in project avatars. Currently, GitLab only supports bitmap formats (PNG, JPEG, GIF, BMP, TIFF, ICO) for project avatars, despite already using SVG images elsewhere in the interface (like the GitLab logo). SVG avatars would provide better visual quality, especially on retina/high-DPI devices, and reduce bandwidth usage since many project logos are vector-based.

Requirements

  1. Allow SVG file uploads for project and group avatars (currently blocked with format error)
  2. Implement proper SVG sanitization to prevent security vulnerabilities from embedded JavaScript
  3. Maintain visual quality of vector graphics instead of converting to pixelated formats

Current state & technical considerations

  • GitLab already has SVG sanitization capabilities (implemented in gitlab-foss!2667 (merged))
  • Profile pictures can accept SVG uploads but are converted to PNG during the crop/resize process, losing vector quality
  • Security concerns about JavaScript in SVGs can be mitigated by using <img> tags instead of inline SVG embedding

Exit criteria

  1. Users can successfully upload SVG files as project and group avatars
  2. SVG avatars maintain their vector quality and scalability
  3. Proper security sanitization prevents any JavaScript execution
  4. SVG avatars display correctly across all GitLab interfaces
Edited by Christina Lohr