3 ms·
Technically, the issue is not that SVG allows active content. It is that untrusted XML is being inserted in the DOM by Scratch. Arbitrary SVG content can be sa
by purkka 5y ago
Technically, the issue is not that SVG allows active content. It is that untrusted XML is being inserted in the DOM by Scratch.
Arbitrary SVG content can be safely embedded as an image, either via the img tag or as a background image.