It is possible to perform a XSS attack by an uploaded svg image file

Reproduction (with saas sample project, but any project will do):

• Prepare a SVG image by adding an onload attribute svg element: <svg onload="alert(1);" ....
• Upload the image to gallery/brxsaas/images
• open the file http://localhost:8080/site/binaries/content/gallery/brxsaas/images/foo.svg

Expect: svg shown with no alert popup

Actual: alert popup displayed.

Solution: Prevent XSS attacks via onload attribute of svg images by removing it from uploaded svg files.