News for hackers. Stuff that matters.

A comment on A few HTML tips. Parent comment

Re:A few HTML tips by manarth on Wednesday August 24, 2016 @11:06AM (#12352559)
> "<svg> may not work for people like me who disable javascript. It introduces potential security issues"

SVG works for me with JS disabled (using Firefox on OS-X). Do you have any pointers on when/why SVG wouldn't work without JS?

[ Parent | on HN ]
Re:A few HTML tips by bo1024 on Thursday August 25, 2016 @04:41AM (#12357640)
I looked into it further and I think I'm mostly wrong about <svg>. You can embed javascript into it, but if you don't, then as far as I can tell it works fine for me. Sorry!
[ Parent | on HN ]
Re:A few HTML tips by manarth on Thursday August 25, 2016 @07:32AM (#12358220)
That makes sense…and I think that's where the potential security vulnerability comes into play - if you allow untrusted users to upload SVGs, then they could potentially be uploading javascript to your site, offering a vector for XSS. As far as I can tell, adding your own SVGs to your site doesn't open up any novel security issues.
[ Parent | on HN ]