4 ms·
"no Javascript" is very misleading. There are several <script> tags embedded in each svg, including at least two scripts that are loaded from external sources.
by hughes 13y ago
"no Javascript" is very misleading. There are several <script> tags embedded in each svg, including at least two scripts that are loaded from external sources.
In fact, nearly 1/3 of the data transferred for the first graph is javascript[0].
https://gist.github.com/hughes/c876b02aa06f897c99e2 https://gist.github.com/hughes/c876b02aa06f897c99e2
- Kiro 13y agoHm, how does this work? How can JavaScript be executed like that when it's included as an image?
- btcfn 13y agohttp://www.w3.org/Graphics/SVG/IG/resources/svgprimer.html#JavaScript http://www.w3.org/Graphics/SVG/IG/resources/svgprimer.html#J...
- dpweb 13y agoCurious about that too. If I load an svg in the address bar with embedded script I can show alert(), but linked into html using <img> tag, alert does not run. Sandboxed? Otherwise I could execute JS just by loading in using svg via <img>.
- hughes 13y agoLooks like it's not sandboxed at all? > Any functions defined within any script element have a global scope across the entire current document. [0] https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script https://developer.mozilla.org/en-US/docs/Web/SVG/Element/scr...
- spb 13y agoAs images / targets, SVG documents have their own global scope, much like a page in an iframe.
- deleted 13y ago[deleted]
- elwell 13y agoIs that just for fallback and also tooltips?