5 ms·

SVG also has more risk: stored XSS, which isn't something you'd expect from a file whose MIME type starts with "image/". https://github.com/w3c/svgwg/issues/26

SVG also has more risk: stored XSS, which isn't something you'd expect from a file whose MIME type starts with "image/". https://github.com/w3c/svgwg/issues/266 https://github.com/w3c/svgwg/issues/266

dsacco 10y ago
Ah, you beat me to it. A practical demonstration of XSS in an SVG is the following: <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert(document.cookie); </script> </svg> I see this in the wild all the time, though these days it's becoming less harmful as more developers learn to host their images (and all user uploaded files, really) on a separate CDN.
- duaneb 10y ago
  Wait, what? Why is embedding a script into an image allowed? WTF? I do not expect my images to be turing complete.
  - comex 10y ago
    Note that it's disabled if the image is loaded with an img tag, so allowing users to embed arbitrary URLs as images is safe. The issue is if you allow uploading of svg files to your own domain, someone can then have their own site redirect to the svg or load it in a frame, at which point it can run scripts from your origin.
  - wongarsu 10y ago
    >I do not expect my images to be turing complete. An image of type "image/svg+xml" is as powerful as a text of type "text/html". In both cases their mime-type could be considered a misnomer. In general I find it more helpful to think of SVG as a xhtml-like format with tags for arbitrary shapes. It has full support for interaction, state, javascript, css and almost anything else you expect from a html document.
  - dredmorbius 10y ago
    SVG is vector, not raster, and in one way of thinking, is embedding instructions on how to present and manipulate an image or set of graphics directives. How close it is to Turing complete I'm not sure -- I've played with them a tad, enough to find them quite adaptable and useful, but have also seen stuff, much of it from David Daley (https://ello.co/ddailey https://ello.co/ddailey) which boggles my poor little brain.
    - TazeTSchnitzel 10y ago
      SVG lets you use ECMAScript, and ECMAScript is Turing-complete.
      - dredmorbius 10y ago
        Thanks.
  - pdkl95 10y ago
    > Why is embedding a script into an image allowed? Because it lets you create vector games: http://public.codenazi.fastmail.fm/asteroids_dynamic.svg http://public.codenazi.fastmail.fm/asteroids_dynamic.svg (a better use would be stuff like D3-style interactive charts) Warning: I never finished that project because SVG rendering was too slow ~6 years ago. Frames would drop on every reflow after any DOM change. Arrows move, space shoots. Collision checks are on so the shield (x) works, but the death animation is disabled in that version. I actually agree that images shouldn't be Turing complete. That's unnecessary in almost every normal situation and only adds attack surface. However, there is a place for animated vector graphics.
- tamana 10y ago
  That's exactly the same as regular HTML
ogig 10y ago
And more. I got a bug bounty by uploading a malicious svg witch would get parsed and fetch external resources, even read local images. If your app receives and parses svg server side you might have a hole there.
- joepvd 10y ago
  > a malicious svg witch You got me interested there ;)
- happyslobro 10y ago
  Forgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.
  - nitrogen 10y ago
    Maybe you need PNG thumbnails for user-uploaded SVGs.
- happyslobro 10y ago
  Forgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.

dsacco 10y ago

Ah, you beat me to it. A practical demonstration of XSS in an SVG is the following: <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert(document.cookie); </script> </svg> I see this in the wild all the time, though these days it's becoming less harmful as more developers learn to host their images (and all user uploaded files, really) on a separate CDN.

duaneb 10y ago
Wait, what? Why is embedding a script into an image allowed? WTF? I do not expect my images to be turing complete.
- comex 10y ago
  Note that it's disabled if the image is loaded with an img tag, so allowing users to embed arbitrary URLs as images is safe. The issue is if you allow uploading of svg files to your own domain, someone can then have their own site redirect to the svg or load it in a frame, at which point it can run scripts from your origin.
- wongarsu 10y ago
  >I do not expect my images to be turing complete. An image of type "image/svg+xml" is as powerful as a text of type "text/html". In both cases their mime-type could be considered a misnomer. In general I find it more helpful to think of SVG as a xhtml-like format with tags for arbitrary shapes. It has full support for interaction, state, javascript, css and almost anything else you expect from a html document.
- dredmorbius 10y ago
  SVG is vector, not raster, and in one way of thinking, is embedding instructions on how to present and manipulate an image or set of graphics directives. How close it is to Turing complete I'm not sure -- I've played with them a tad, enough to find them quite adaptable and useful, but have also seen stuff, much of it from David Daley (https://ello.co/ddailey https://ello.co/ddailey) which boggles my poor little brain.
  - TazeTSchnitzel 10y ago
    SVG lets you use ECMAScript, and ECMAScript is Turing-complete.
    - dredmorbius 10y ago
      Thanks.
- pdkl95 10y ago
  > Why is embedding a script into an image allowed? Because it lets you create vector games: http://public.codenazi.fastmail.fm/asteroids_dynamic.svg http://public.codenazi.fastmail.fm/asteroids_dynamic.svg (a better use would be stuff like D3-style interactive charts) Warning: I never finished that project because SVG rendering was too slow ~6 years ago. Frames would drop on every reflow after any DOM change. Arrows move, space shoots. Collision checks are on so the shield (x) works, but the death animation is disabled in that version. I actually agree that images shouldn't be Turing complete. That's unnecessary in almost every normal situation and only adds attack surface. However, there is a place for animated vector graphics.
tamana 10y ago
That's exactly the same as regular HTML

ogig 10y ago

And more. I got a bug bounty by uploading a malicious svg witch would get parsed and fetch external resources, even read local images. If your app receives and parses svg server side you might have a hole there.

joepvd 10y ago
> a malicious svg witch You got me interested there ;)
happyslobro 10y ago
Forgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.
- nitrogen 10y ago
  Maybe you need PNG thumbnails for user-uploaded SVGs.
happyslobro 10y ago
Forgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.