TESTHEON Practice Lab
AdvancedPW-FILE-00240 minutesPlaywright

Reject active SVG content

An upload carrying active SVG content must never reach private storage.

  • files
  • security

Objective

What to automate

Attempt to upload an SVG with a script and verify safe rejection.

Preconditions and test data

Preconditions

  • Use a fresh isolated Practice Lab browser context.
  • Open the fixture identified by FX-FILE-001.

Test data

  • filename: unsafe.svg
  • content: <svg><script>alert(1)</script></svg>

Expected result

The API rejects the file, reports the allowlist/content rule, and creates no download token.

Open practice pageRead related guide

Progressive hints

Hint 1

Build the file payload in memory.

Hint 2

Assert the error code rather than browser wording alone.

Hint 3

Verify no accepted file row or token appears.

I’ve tried it — show solution
  1. Build the file payload in memory.
  2. Assert the error code rather than browser wording alone.
  3. Verify no accepted file row or token appears.