Ah interesting. It's probably a pretty clean implementation then. No immediate workarounds come to mind. There's ways you can obscure things, such as using an

Ah interesting. It's probably a pretty clean implementation then. No immediate workarounds come to mind. There's ways you can obscure things, such as using an object tag, leaving it up to the browser to decide via a mime type header which you specify then as svg, buuut that won't work here. Things are fairly locked down these days. Maybe there's something I'm not thinking of using a similar pattern (confuse the browser, tell it the answer and then have it generate the restricted type) ... Maybe something dealing with lang or codepages... There's still plenty of shenanigans there. Back in the day I used to upload full-blown servers I wrote in postscript as my "profile image" and then they were blindly executed when trying to "convert" the file - imagemagick locked that down about 10 years ago though. Even back then usually some max execution timer would kill it after a minute or so. But it was fun.