The Woes of Sanitizing SVGs

Re:The Woes of Sanitizing SVGs by ikkun on Monday April 27, 2026 @12:27PM (#47923702)

I do wish tinyVG or similar would take off, but I don't see that ever actually happening. the only thing I think it's missing is animation support, which is pretty niche but not as niche as <script> tags.

https://tinyvg.tech/

[ Parent | on HN ]

Re:The Woes of Sanitizing SVGs by hajile on Tuesday April 28, 2026 @09:39AM (#47934440)

We need a secondary official SSVG (Secure SVG) spec so the changes can be guaranteed by browsers and other implementors.

This would allow an update to the xmlns to

    <svg xmlns="http://www.w3.org/2000/ssvg">

Which would allow the image to force SSVG mode and disable all non-approved features, but you could also update the image tag so the client could force security on potentially insecure SVGs

    <img type="ssvg" src="/insecure.svg">

[ Parent | on HN ]