News for hackers. Stuff that matters.

A comment on Web Graphics Done Right. Parent comment

Re:Web Graphics Done Right by throwaway_bad on Monday October 07, 2019 @01:26PM (#21183497)
One case where you probably can't is for image uploads. You might think it would be nice to allow a user to upload a svg for their avatar or something.

But SVG can embed javascript which can lead to XSS: https://hackerone.com/reports/148853

[ Parent | on HN ]
Re:Web Graphics Done Right by pekim on Monday October 07, 2019 @03:03PM (#21184687)
That's certainly something to be considered with user uploaded svg images. However it's reasonably straightforward to parse an svg and remove any script elements.
[ Parent | on HN ]
Re:Web Graphics Done Right by microcolonel on Monday October 07, 2019 @04:52PM (#21185827)
You can safely use XSLT to subset SVG, and (for example) limit complexity. Scripts in SVGs do not load in img tags either.
[ Parent | on HN ]