4 ms·

The SVG is embedded using an iframe tag, so JS can run and mess with its DOM. SVG in an img tag can't run JS, as with jpgs or pngs. https://developer.mozilla.or

• whorleater 9y ago
  This definitely seems like something you shouldn't rely on and may change in the future (either due to browser bugs, actual shift in policy, or browser differences)
  • twotwotwo 9y ago
    As someone else commented, the spec doesn't just omit running scripts via img tags, it explicitly excludes it, both the general idea of img being scriptable or interactive, and scripted SVG specifically (in the Note: part): https://dev.w3.org/html5/spec-preview/the-img-element.html#attr-img-src https://dev.w3.org/html5/spec-preview/the-img-element.html#a... I think the spec authors and browser vendors are more than savvy enough to know that "img tags don't run scripts" is a security-relevant promise that authors will rely on; I'm not so convinced it's uniquely unreliable compared to the many other security-relevant corner cases out there. There are other reasons to treat user-provided content specially, whatever format, so maybe you end up in a similar place no matter what. I just don't want folks to be left thinking that the behavior here is unspecified or such.
    • jonathanstrange 9y ago
      But as someone else found out, if you choose "View Image", then the SVG's JS will run.
      • twotwotwo 9y ago
        (For the record, since another site could cause XSS by iframing the same .svg you loaded in an img tag, yes, definitely don't host random SVGs on your domain. Wish I'd thought of that in my earlier message.)