3 ms·
If you use mesh gradient with Inkscape, it will append about 17K of Javascript to the end of the SVG that starts like this: <script id="mesh_polyfill" type
by omoikane 3y ago
If you use mesh gradient with Inkscape, it will append about 17K of Javascript to the end of the SVG that starts like this:
<script id="mesh_polyfill" type="text/javascript">
It surprised me the first time I saw it.
The script appears to be minimized version of what's here:
https://gitlab.com/inkscape/inkscape/-/tree/master/src/extension/internal/polyfill https://gitlab.com/inkscape/inkscape/-/tree/master/src/exten...
- lol768 3y agoDoes it warn you? This sort of "magic" could do with a giant disclaimer really..
- omoikane 3y agoYou can tell Inkscape not to insert those scripts (edit -> input/output -> SVG export -> uncheck the two options for inserting javascript), but you have to know to look for them, and I suspect most people don't look at the output SVGs. These compatibility polyfills seem harmless so it doesn't bother me, but maybe you are asking if Inkscape can be used to pass arbitrary javascript to unsuspecting viewers without warning? The answer to that appears to be "yes" via the extensions system.
- lol768 3y agoIt's not malicious, but if you're expecting to be able to use the SVG in the context of an <img> element, or on a site with a strict (in line with security best practice) Content-Security-Policy, this is just a sharp edge that you can cut yourself on because the polyfill simply won't work in those contexts. I know I'd be annoyed if I realised my image editor had "tried to be clever" and done this under the hood without telling me.