4 ms·

The example SVG: https://berthub.eu/trifecta/i/Tcp2y3TbBzU https://berthub.eu/trifecta/i/Tcp2y3TbBzU doesn't execute the javascript when visited directly in an

• masklinn 3y ago
  If linked via an <img> tag, browsers will run the SVG in a script-less context. The problem is direct linking, then you have a potential XSS. Here it’s the CSP directive (Content-Security-Policy: script-src ‘none’) which is neutering it, as indicated by the comment your got the SVG from. However from what I remember of my experiments script-src none can severely degrade SVGs even though they don’t use JS, because it affects some styling.
• tlhunter 3y ago
  According to the page the HTTP CORS headers prevent JS execution. But the problem remains that svg can embed and execute JS on servers without these non-default headers.
  • lol768 3y ago
    CSP, not CORS. CORS is for allowing other origins to read resources (and send special requests/special headers). It's not really relevant here.
• geor9e 3y ago
  If you save it locally then drag it into your browser, it will run. Bert blocked it from running when hosted on his domain a couple days ago https://github.com/berthubert/trifecta/commit/ed7a10d783dda2fafc825c82382d16ffdc19aca9 https://github.com/berthubert/trifecta/commit/ed7a10d783dda2...