3 ms·

Normally this isn’t a problem. If the SVG is included with an <img> Tag the JS won’t execute. If you directly embed the SVG tags into the HTML it will. But sure

Normally this isn’t a problem. If the SVG is included with an <img> Tag the JS won’t execute. If you directly embed the SVG tags into the HTML it will. But surely no one does this with SVGs they receive from untrustworthy 3rd parties right? Except a web performance best practice (for non-H2 sites) is to inline images into the HTML... and there are some auto-optimizing libraries that will embed SVG as <SVG> tags instead of as a data: URI... Yep. I know of a few persistent XSS vulns in a few top Alexa sites because of this :-D

cbr 9y ago
a web performance best practice (for non-H2 sites) is to inline images into the HTML... and there are some auto- optimizing libraries that will embed SVG as <SVG> tags instead of as a data: URI... When I worked on mod_pagespeed (a website auto-optimizer) we wouldn't have it touch SVGs at all because there are so many potential security issues there. (And it wasn't widely used enough to be worth it given the risks.)
- billyhoffman 9y ago
  Thanks for your work on mod_pagespeed. It was an awesome approach for FEO. It's not that problem. I see this issue primarily in some semi-popular build/publishing plugins.
djsumdog 9y ago
I think back to the XML readers and XSLT parsers that could read arbitrary files or the fact that you can technically embed flash in a PDF (which is just a wrapper around Postscript). It's things like these that lead to security issues. Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea?
- pcwalton 9y ago
  > Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea? Adobe, when they were trying to position SVG as a competitor to Macromedia's Flash.
  - hvidgaard 9y ago
    It's the antithesis of good design. But that doesn't surprise me, coming from the company that designed the clusterfuck that is pdf. It's ubiquitously in everything tech, and an absolute nightmare to embed.
- jwilk 9y ago
  > PDF (which is just a wrapper around Postscript) No? PDF and PostScript are entirely different languages.
Pxtl 9y ago
Honestly, they should treat those as two different formats - like SVG and WSVG or something. Dumb file vs vector-graphics web-application platform.
- dvddgld 9y ago
  Yep, talk about scope creep...

cbr 9y ago

a web performance best practice (for non-H2 sites) is to inline images into the HTML... and there are some auto- optimizing libraries that will embed SVG as <SVG> tags instead of as a data: URI... When I worked on mod_pagespeed (a website auto-optimizer) we wouldn't have it touch SVGs at all because there are so many potential security issues there. (And it wasn't widely used enough to be worth it given the risks.)

billyhoffman 9y ago
Thanks for your work on mod_pagespeed. It was an awesome approach for FEO. It's not that problem. I see this issue primarily in some semi-popular build/publishing plugins.

djsumdog 9y ago

I think back to the XML readers and XSLT parsers that could read arbitrary files or the fact that you can technically embed flash in a PDF (which is just a wrapper around Postscript). It's things like these that lead to security issues. Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea?

pcwalton 9y ago
> Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea? Adobe, when they were trying to position SVG as a competitor to Macromedia's Flash.
- hvidgaard 9y ago
  It's the antithesis of good design. But that doesn't surprise me, coming from the company that designed the clusterfuck that is pdf. It's ubiquitously in everything tech, and an absolute nightmare to embed.
jwilk 9y ago
> PDF (which is just a wrapper around Postscript) No? PDF and PostScript are entirely different languages.

Pxtl 9y ago

Honestly, they should treat those as two different formats - like SVG and WSVG or something. Dumb file vs vector-graphics web-application platform.

dvddgld 9y ago
Yep, talk about scope creep...