3 ms·
> But any hosting platforms that hosts your content on their domain should filter out any JavaScript on SVG as it would on HTML. That's definitely not a thing
by inetknght 6y ago
> But any hosting platforms that hosts your content on their domain should filter out any JavaScript on SVG as it would on HTML.
That's definitely not a thing that happens. Web servers just serve the file as-is.
- mormegil 6y agoThe point is they either need to filter the served content, or serve it from a different domain (e.g. githubusercontent.com), otherwise you have XSS-like problems.
- michaelmior 6y agoMy understanding is that things like this are one of the reasons GitHub moved GitHub Pages subdomains from github.com to github.io.
- deleted 6y ago[deleted]
- Kiro 6y agoSee https://news.ycombinator.com/item?id=25350248 https://news.ycombinator.com/item?id=25350248
- felixfbecker 6y agoGitHub raw endpoints do it. They will either serve the SVG without an image/svg+xml Content-Type, making it not render in the browser, or you have to append ?sanitize=true to the URL which will, as the name suggest, sanitize it.