An XML-based vector image format for two-dimensional graphics with support for interactivity and animation.

learn more… | top users | synonyms

-1
votes
1answer
51 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = ...
3
votes
1answer
73 views

Can an XXE (XML External Entity) attack be carried out from within an SVG file?

Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
2
votes
1answer
106 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
0
votes
3answers
253 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
3
votes
2answers
156 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an ...
0
votes
2answers
179 views

SVG-Snippets in Access-Log: Probe or Error?

I get some hits every then and there from different IPs, always the same scheme: GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 ...
13
votes
2answers
2k views

Why does this XSS vector work in svg but not in HTML?

Why does this vector : <svg><script>alert&#40/1/.source&#41</script> works in http://jsfiddle.net/ZgPY4/2/ and this one ...