5 ms·

It appears to be part of the spec, [0] although there appears to be no requirement for the SVG User Agent to support any particular scripting language. This is

by dpwm 9y ago

It appears to be part of the spec, [0] although there appears to be no requirement for the SVG User Agent to support any particular scripting language. This is interesting from a security perspective, because it effectively means SVGs can contain scripts. If I was a security researcher, this sort of little-known but apparently widely supported feature is exactly where I would be looking for vulnerabilities. [0] https://www.w3.org/TR/SVG/script.html#ScriptElement https://www.w3.org/TR/SVG/script.html#ScriptElement

microcolonel 9y ago
> If I was a security researcher, this sort of little-known but apparently widely supported feature is exactly where I would be looking for vulnerabilities. Well, it's not really a thing. In a browser (the only kind of UA that'll really run any scripts in an SVG), SVG basically gets treated as SGML, all the DOM stuff is the same. If you include it as an image tag, the scripts don't tend to run, AFAIK. Added to clarify: The types of things you could exploit in a scripted SVG but which wouldn't also apply to HTML, would tend to be exploitable in a static SVG as well.
- dpwm 9y ago
  That's a relief. I see from the page it's embedded as an iframe, which I didn't know you could do. Changing the iframe to an img on the page does indeed prevent the script executing, at least on Firefox.
  - edent 9y ago
    The script also works if the SVG is written inline. Sadly, WordPress makes that tricky on my site.
  - amenghra 9y ago
    Proof that it doesn't work when used in an <img> tag: https://jsfiddle.net/8rcrfpwn/ https://jsfiddle.net/8rcrfpwn/
    - four_serenity 9y ago
      It does work with an <object> tag, though: https://jsfiddle.net/8rcrfpwn/4/ https://jsfiddle.net/8rcrfpwn/4/
- sebcat 9y ago
  > Well, it's not really a thing. In a browser (the only kind of UA that'll really run any scripts in an SVG), SVG basically gets treated as SGML, all the DOM stuff is the same. If you include it as an image tag, the scripts don't tend to run, AFAIK It breaks expectations. I havn't looked at it recently, but it used to be the case that hosting user submitted SVGs on your domain could yield JS-execution in the origin context. Embedding or iframing without sandbox isn't/wasn't secure either. A quick google search on SVG XSS gives: https://hackerone.com/reports/148853 https://hackerone.com/reports/148853 https://phabricator.wikimedia.org/T85850 https://phabricator.wikimedia.org/T85850
  - noblethrasher 9y ago
    On the other hand, I think it would be straightforward to strip script tags and attributes using XSLT. You could even go as far as just whitelisting certain tags/attributes.
  - microcolonel 9y ago
    > I havn't looked at it recently, but it used to be the case that hosting user submitted SVGs on your domain could yield JS-execution in the origin context. Oh definitely, though that's more an administrative problem than a platform problem. Webmasters (or whoever that task falls to today) must understand that SVGs are exactly as dangerous as HTML files in exactly the same ways. Where you would sanitize user-provided HTML, you must also sanitize user-provided SVG.
- im3w1l 9y ago
  So let's say you use an img tag, but the user right clicks and chooses view image? Navigating to the svg seems to run the scripts.
  - zaroth 9y ago
    > Navigating to the svg seems to run the scripts. Now that seems like a bug.
    - WorldMaker 9y ago
      If I recall correctly, Mozilla thought so too and recently disabled scripts in direct SVG navigation and data: URIs in recent versions of Firefox.
      - WorldMaker 9y ago
        Well, direct navigation worked when I tried it now and I can't seem to turn up the blog post I thought commented on the situation, so my recollection here may be in question.
- deleted 9y ago
  [deleted]
imaginenore 9y ago
That's pretty insane and irresponsible to just drop this bombshell in the middle of the spec. "Oh, by the way, our image format allows for embedded scripts. We won't tell you what the scope is, or even what languages are allowed. Deal with it.".

by dpwm 9y ago

microcolonel 9y ago

> If I was a security researcher, this sort of little-known but apparently widely supported feature is exactly where I would be looking for vulnerabilities. Well, it's not really a thing. In a browser (the only kind of UA that'll really run any scripts in an SVG), SVG basically gets treated as SGML, all the DOM stuff is the same. If you include it as an image tag, the scripts don't tend to run, AFAIK. Added to clarify: The types of things you could exploit in a scripted SVG but which wouldn't also apply to HTML, would tend to be exploitable in a static SVG as well.

dpwm 9y ago
That's a relief. I see from the page it's embedded as an iframe, which I didn't know you could do. Changing the iframe to an img on the page does indeed prevent the script executing, at least on Firefox.
- edent 9y ago
  The script also works if the SVG is written inline. Sadly, WordPress makes that tricky on my site.
- amenghra 9y ago
  Proof that it doesn't work when used in an <img> tag: https://jsfiddle.net/8rcrfpwn/ https://jsfiddle.net/8rcrfpwn/
  - four_serenity 9y ago
    It does work with an <object> tag, though: https://jsfiddle.net/8rcrfpwn/4/ https://jsfiddle.net/8rcrfpwn/4/
sebcat 9y ago
> Well, it's not really a thing. In a browser (the only kind of UA that'll really run any scripts in an SVG), SVG basically gets treated as SGML, all the DOM stuff is the same. If you include it as an image tag, the scripts don't tend to run, AFAIK It breaks expectations. I havn't looked at it recently, but it used to be the case that hosting user submitted SVGs on your domain could yield JS-execution in the origin context. Embedding or iframing without sandbox isn't/wasn't secure either. A quick google search on SVG XSS gives: https://hackerone.com/reports/148853 https://hackerone.com/reports/148853 https://phabricator.wikimedia.org/T85850 https://phabricator.wikimedia.org/T85850
- noblethrasher 9y ago
  On the other hand, I think it would be straightforward to strip script tags and attributes using XSLT. You could even go as far as just whitelisting certain tags/attributes.
- microcolonel 9y ago
  > I havn't looked at it recently, but it used to be the case that hosting user submitted SVGs on your domain could yield JS-execution in the origin context. Oh definitely, though that's more an administrative problem than a platform problem. Webmasters (or whoever that task falls to today) must understand that SVGs are exactly as dangerous as HTML files in exactly the same ways. Where you would sanitize user-provided HTML, you must also sanitize user-provided SVG.
im3w1l 9y ago
So let's say you use an img tag, but the user right clicks and chooses view image? Navigating to the svg seems to run the scripts.
- zaroth 9y ago
  > Navigating to the svg seems to run the scripts. Now that seems like a bug.
  - WorldMaker 9y ago
    If I recall correctly, Mozilla thought so too and recently disabled scripts in direct SVG navigation and data: URIs in recent versions of Firefox.
    - WorldMaker 9y ago
      Well, direct navigation worked when I tried it now and I can't seem to turn up the blog post I thought commented on the situation, so my recollection here may be in question.
deleted 9y ago
[deleted]

imaginenore 9y ago

That's pretty insane and irresponsible to just drop this bombshell in the middle of the spec. "Oh, by the way, our image format allows for embedded scripts. We won't tell you what the scope is, or even what languages are allowed. Deal with it.".