Hacker News Reader

Comment by billyhoffman | Hacker News Reader

Normally this isn’t a problem. If the SVG is included with an <img> Tag the JS won’t execute. If you directly embed the SVG tags into the HTML it will. But surely no one does this with SVGs they receive from untrustworthy 3rd parties right?

Except a web performance best practice (for non-H2 sites) is to inline images into the HTML... and there are some auto-optimizing libraries that will embed SVG as <SVG> tags instead of as a data: URI...

Yep. I know of a few persistent XSS vulns in a few top Alexa sites because of this :-D

View on HN

    a web performance best practice (for non-H2 sites) is to
    inline images into the HTML... and there are some auto-
    optimizing libraries that will embed SVG as <SVG> tags
    instead of as a data: URI...

When I worked on mod_pagespeed (a website auto-optimizer) we wouldn't have it touch SVGs at all because there are so many potential security issues there. (And it wasn't widely used enough to be worth it given the risks.)

Thanks for your work on mod_pagespeed. It was an awesome approach for FEO. It's not that problem. I see this issue primarily in some semi-popular build/publishing plugins.

Honestly, they should treat those as two different formats - like SVG and WSVG or something. Dumb file vs vector-graphics web-application platform.

Yep, talk about scope creep...

I think back to the XML readers and XSLT parsers that could read arbitrary files or the fact that you can technically embed flash in a PDF (which is just a wrapper around Postscript).

It's things like these that lead to security issues.

Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea?

> Honestly when I read that first line about SVG and Javascript, I was a little horrified. Who the fuck on what planet ever though that could possible be a good idea?

Adobe, when they were trying to position SVG as a competitor to Macromedia's Flash.

It's the antithesis of good design. But that doesn't surprise me, coming from the company that designed the clusterfuck that is pdf. It's ubiquitously in everything tech, and an absolute nightmare to embed.

> PDF (which is just a wrapper around Postscript)

No? PDF and PostScript are entirely different languages.

Reply on news.ycombinator.com