4 ms·
> Opening “data:image/*” in top-level window, unless it’s “data:image/svg+xml” Just curious-- why the exception for svg?
by jancsika 9y ago
> Opening “data:image/*” in top-level window, unless it’s “data:image/svg+xml”
Just curious-- why the exception for svg?
- croddin 9y agoI think they block svg but not other images because svgs can contain javascript and could be used in a phishing attack. i.e. data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'><script>alert('hi')</script></svg>
- jancsika 9y agoOh wow, even if you right-click "View Image" the script gets run.