3 ms·
My first thought was nefarious cross-site injection capabilities. 1. Upload huge sets of normal SVG files. 2. Once adoption grows, swap them out for nefarious
by graphememes 8y ago
My first thought was nefarious cross-site injection capabilities.
1. Upload huge sets of normal SVG files.
2. Once adoption grows, swap them out for nefarious SVGs.
3. Wait.
- jansan 8y agoYou are right, you should use an SVG sanitizer if you intend to inject SVGs that are not fully under your control. The sanitizer can be applied before actual injection takes place, so a mischievous SVG can do harm.
- est31 8y agoOr just use subresource integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...