Add env var to exclude SVG (or other passthrough-only formats) from auto webp/avif conversion

[Object905]

Currently IMAGOR_AUTO_WEBP/IMAGOR_AUTO_AVIF force content-negotiated output on every source image, including SVG. Since webp/avif are savable by libvips, SVG gets rasterized instead of passed through — even with no resize/format filters in the request URL.

Passthrough (documented behavior when the output format can't be produced by libvips) never triggers here, because auto-webp/avif always names a producible format.

Request: an env var (e.g. IMAGOR_AUTO_WEBP_EXCLUDE_MIME / similar) to skip auto format negotiation for specific source mime types — SVG being the main case — so vector sources stream through untouched while raster sources still get webp/avif optimization.
Right now we have a hacky logic on frontend to do this with thumbor. It would be nice to get rid of it.

Workaround today: disable IMAGOR_AUTO_WEBP/IMAGOR_AUTO_AVIF globally, losing the optimization for all other formats.

[cshum]

Thanks for the write-up - this is a valid issue. I'd like to push back on the exclude-MIME approach though. A growing list of per-source-format excludes (IMAGOR_AUTO_WEBP_EXCLUDE_MIME, then AVIF's, then whatever comes next) feels like the wrong abstraction, and doesn't address the underlying "SVG gets rasterized by default" behavior.

The design I would rather go with is to give imagor the ability to serve SVG as SVG when no transformation is actually requested - e.g. an IMAGOR_SVG_PASSTHROUGH=1 option (default off, opt-in), rather than a special-case MIME allow/denylist. When enabled, passthrough takes precedence over auto WebP/AVIF negotiation for no-op requests, so SVG sources stream through untouched while raster sources still get their optimization.

Currently, rasterization is the default is because image operations are only possible via rasterization.

But most importantly, returning SVG directly is a security problem. SVG is an executable markup:

• <script> and inline onload/onerror/etc. event-handler attributes execute when the document is loaded in any context that can run scripts.
• It's not only about <img> tags — the browser context is attacker-controlled. A top-level navigation to the SVG URL, target="_blank" with window.opener,
  embedding via data: URI, or opening in a new tab all behave very differently from <img src>.
• <foreignObject> can carry arbitrary HTML into the SVG.
• External references (<image href="...">, etc.) can also leak or fingerprint data cross-origin.

Just to name a few. Serving an unsanitized upstream SVG means handing an attacker easy XSS on your domain - and imagor loads from untrusted/uploaded URLs by default, so we can't assume the source is trusted. Doing this properly means sanitizing the SVG on the way out, before it's served. That's security-sensitive work that has to be right the first time, and it's a big part of why the "easiest" option shipped first was rasterizing everything.

I would rather implement SVG passthrough + sanitization than MIME exclude lists, and I'll keep this issue open for tracking.