An XML-based vector image format for two-dimensional graphics with support for interactivity and animation.

learn more… | top users | synonyms

2
votes
1answer
106 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
0
votes
3answers
231 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
2
votes
2answers
151 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an ...
-1
votes
2answers
173 views

SVG-Snippets in Access-Log: Probe or Error?

I get some hits every then and there from different IPs, always the same scheme: GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 ...
11
votes
2answers
2k views

Why does this XSS vector work in svg but not in HTML?

Why does this vector : <svg><script>alert&#40/1/.source&#41</script> works in http://jsfiddle.net/ZgPY4/2/ and this one ...