4 ms·
And more. I got a bug bounty by uploading a malicious svg witch would get parsed and fetch external resources, even read local images. If your app receives and
by ogig 10y ago
And more. I got a bug bounty by uploading a malicious svg witch would get parsed and fetch external resources, even read local images.
If your app receives and parses svg server side you might have a hole there.
- joepvd 10y ago> a malicious svg witch You got me interested there ;)
- happyslobro 10y agoForgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.
- nitrogen 10y agoMaybe you need PNG thumbnails for user-uploaded SVGs.
- happyslobro 10y agoForgive my ignorance, but why would anyone ever need to parse an SVG server side? Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.