wikimedia / mediawiki

		/*

		 * check for elements that can contain javascript

		 */

		if ( $strippedElement == 'script' ) {

			wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" );

			return [ 'uploaded-script-svg', $strippedElement ];

		}

		# e.g., <svg xmlns="http://www.w3.org/2000/svg">

		#  <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>

		# e.g., <svg xmlns="http://www.w3.org/2000/svg">

		#  <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>

		if ( $strippedElement == 'handler' ) {

			wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );

			return [ 'uploaded-script-svg', $strippedElement ];

		}

		# SVG reported in Feb '12 that used xml:stylesheet to generate javascript block

		if ( $strippedElement == 'stylesheet' ) {

		}

		# SVG reported in Feb '12 that used xml:stylesheet to generate javascript block

		if ( $strippedElement == 'stylesheet' ) {

			wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );

			return [ 'uploaded-script-svg', $strippedElement ];

		}

		# Block iframes, in case they pass the namespace check

		if ( $strippedElement == 'iframe' ) {