I wrote a JQuery tool to preview images before uploads.
- User A clicks the explore button to select an image
- selects it
- a change-event displays the image
If user A selects a prepared SVG image as "greetings_ILL_xss_your_site.svg" or "greetings_ILL_xss_your_site.gif" my JQuery will get the image from tmp dir, resize and display it.
As svg are small programs, and gif can contain scripts:
- Could it run code that uses XSS scripts?
- Is the previewed image authenticated to run script requests?