News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by staticassertion on Thursday December 18, 2025 @10:36PM (#46322034)
Disabling script execution in svgs is very easy, it's just also easy to not realize you're about to embed an svg. `<img src="evil.svg">` will not execute scripts, a bit like your "noscripting" attribute except it's already around and works. Content Security Policy will prevent execution as well, you should be setting one for image endpoints that blocks scripts.

Sanitizing is hard to get right by comparison (svgs can reference other svgs) but it's still a good idea.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by rslashuser on Friday December 19, 2025 @01:38AM (#46322879)
I had the impression from elsewhere in this thread that loading the svg in some other way, then you are not protected. This makes a no-brainer "don't run these ever" option in the browser seem appealing.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by zahlman on Friday December 19, 2025 @03:52PM (#46330759)
> This makes a no-brainer "don't run these ever" option in the browser seem appealing.

Firefox has this: svg.disabled in about:config. It doesn't seem to be properly documented, and might cause other problems for the developer (I found it accidentally, and a more deliberate search turns up mainly bug tracker entries.)

[ Parent | on HN ]