I’m still not sure how people are comfortable opening a crash-y image or HTML file directly in the browser without seeing the source, probably not in a sandbox environment. Clever developers may right-click the link to save it locally, but Bugzilla is open to everyone, so I think such a practice need to be changed. Anyway, all I have to do here is preventing SVG images from being previewed. Certain GIF, PNG, JPEG and WebP files may also lead to a crash or hang, but those are generally safer than SVG.
Bug 1538383 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I’m still not sure how people are comfortable opening a crash-y image or HTML file directly in the browser without seeing the source, probably not in a sandbox environment. Clever developers may right-click the link to save it locally, but Bugzilla is open to everyone, so I think such a practice needs to be changed. Anyway, all I have to do here is preventing SVG images from being previewed. Certain GIF, PNG, JPEG and WebP files may also lead to a crash or hang, but those are generally safer than SVG.