4 ms·

And this is why you cannot easily host arbitrary user-uploaded SVGs on your website. One of the reasons why svgs are not as ubiquitous as png or jpg.

twotwotwo 9y ago
The SVG is embedded using an iframe tag, so JS can run and mess with its DOM. SVG in an img tag can't run JS, as with jpgs or pngs. https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_Image https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_I...
- whorleater 9y ago
  This definitely seems like something you shouldn't rely on and may change in the future (either due to browser bugs, actual shift in policy, or browser differences)
  - twotwotwo 9y ago
    As someone else commented, the spec doesn't just omit running scripts via img tags, it explicitly excludes it, both the general idea of img being scriptable or interactive, and scripted SVG specifically (in the Note: part): https://dev.w3.org/html5/spec-preview/the-img-element.html#attr-img-src https://dev.w3.org/html5/spec-preview/the-img-element.html#a... I think the spec authors and browser vendors are more than savvy enough to know that "img tags don't run scripts" is a security-relevant promise that authors will rely on; I'm not so convinced it's uniquely unreliable compared to the many other security-relevant corner cases out there. There are other reasons to treat user-provided content specially, whatever format, so maybe you end up in a similar place no matter what. I just don't want folks to be left thinking that the behavior here is unspecified or such.
    - jonathanstrange 9y ago
      But as someone else found out, if you choose "View Image", then the SVG's JS will run.
      - twotwotwo 9y ago
        (For the record, since another site could cause XSS by iframing the same .svg you loaded in an img tag, yes, definitely don't host random SVGs on your domain. Wish I'd thought of that in my earlier message.)
sqquuiiiddd 9y ago
Wonder if you could sanitize it. Drop script tags?
- silverwind 9y ago
  SVGO has a option to drop script tags, thought it's not enabled by default.
- extrapickles 9y ago
  Browsers will ignore scripts if you load the SVG in a img element.
983 9y ago
Another reason is that you can recursively define shapes in SVGs and many browsers will happily keep rendering until they run out of memory. WARNING: MIGHT FREEZE YOUR BROWSER/OS. CLICK AT YOUR OWN RISK. https://983.github.io/website/random/slow_1.svg https://983.github.io/website/random/slow_1.svg
- amenod 9y ago
  Browser makers still don't seem to understand that they are developing a new OS, where resource management and defending resources from possibly malicious 3rd parties is their core business. It's incredible that we have no way to limit memory and CPU consumption, or that browser doesn't do that automatically. EDIT: interesting, your link made FF sweat, but it didn't stop working when I closed the tab - I had to manually kill the offending process.
  - 983 9y ago
    I fully agree. Imagine my surprise when I was searching the issue trackers for Chromium and Firefox and found that apparently it is fine that SVGs can crash/lock up your browser or even your computer.
  - jacobush 9y ago
    It took the actual OS makers decades to realise the same thing.
    - mmjaa 9y ago
      .. and just as they were starting to wise up, they decided they wanted to write a browser instead. Insane.
amenghra 9y ago
Never host arbitrary user-uploaded files on your site. Put them in a sandboxed domain (e.g. per-user-random-string.<yourdomain>-userdata.com). Being able to upload arbitrary files has enabled many many web security bypasses, with the result ranging from xss to csrf.

twotwotwo 9y ago

The SVG is embedded using an iframe tag, so JS can run and mess with its DOM. SVG in an img tag can't run JS, as with jpgs or pngs. https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_Image https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_I...

whorleater 9y ago
This definitely seems like something you shouldn't rely on and may change in the future (either due to browser bugs, actual shift in policy, or browser differences)
- twotwotwo 9y ago
  As someone else commented, the spec doesn't just omit running scripts via img tags, it explicitly excludes it, both the general idea of img being scriptable or interactive, and scripted SVG specifically (in the Note: part): https://dev.w3.org/html5/spec-preview/the-img-element.html#attr-img-src https://dev.w3.org/html5/spec-preview/the-img-element.html#a... I think the spec authors and browser vendors are more than savvy enough to know that "img tags don't run scripts" is a security-relevant promise that authors will rely on; I'm not so convinced it's uniquely unreliable compared to the many other security-relevant corner cases out there. There are other reasons to treat user-provided content specially, whatever format, so maybe you end up in a similar place no matter what. I just don't want folks to be left thinking that the behavior here is unspecified or such.
  - jonathanstrange 9y ago
    But as someone else found out, if you choose "View Image", then the SVG's JS will run.
    - twotwotwo 9y ago
      (For the record, since another site could cause XSS by iframing the same .svg you loaded in an img tag, yes, definitely don't host random SVGs on your domain. Wish I'd thought of that in my earlier message.)

sqquuiiiddd 9y ago

Wonder if you could sanitize it. Drop script tags?

silverwind 9y ago
SVGO has a option to drop script tags, thought it's not enabled by default.
extrapickles 9y ago
Browsers will ignore scripts if you load the SVG in a img element.

983 9y ago

Another reason is that you can recursively define shapes in SVGs and many browsers will happily keep rendering until they run out of memory. WARNING: MIGHT FREEZE YOUR BROWSER/OS. CLICK AT YOUR OWN RISK. https://983.github.io/website/random/slow_1.svg https://983.github.io/website/random/slow_1.svg

amenod 9y ago
Browser makers still don't seem to understand that they are developing a new OS, where resource management and defending resources from possibly malicious 3rd parties is their core business. It's incredible that we have no way to limit memory and CPU consumption, or that browser doesn't do that automatically. EDIT: interesting, your link made FF sweat, but it didn't stop working when I closed the tab - I had to manually kill the offending process.
- 983 9y ago
  I fully agree. Imagine my surprise when I was searching the issue trackers for Chromium and Firefox and found that apparently it is fine that SVGs can crash/lock up your browser or even your computer.
- jacobush 9y ago
  It took the actual OS makers decades to realise the same thing.
  - mmjaa 9y ago
    .. and just as they were starting to wise up, they decided they wanted to write a browser instead. Insane.

amenghra 9y ago

Never host arbitrary user-uploaded files on your site. Put them in a sandboxed domain (e.g. per-user-random-string.<yourdomain>-userdata.com). Being able to upload arbitrary files has enabled many many web security bypasses, with the result ranging from xss to csrf.