Hacker News Reader

I see a big security problem with SVG: browsers allow executing scripts in SVG files in site security context, so you have to check for a lot of script execution vectors in SVG before you allow uploading user files.

https://github.com/wikimedia/mediawiki/blob/4aa9e1/includes/...

View on HN

my understanding is that svg in <img> is safe but prevents script execution

svg in iframe + srcdoc + sandbox gives you sortof-inline svg with separate security contexts.

only plain inlined svg should be a security risk.

If you host SVG file on the same domain as the main site, I can give a direct link to the SVG file and your browser will execute arbitrary JavaScript in that context.

I think in that case setting the CSP sandbox header to "allow-scripts" would have the same effect as the iframe sandbox attribute and allow script execution in the SVG but prevent same-origin access and various other things.

Reply on news.ycombinator.com