XSS using SVG: Is AllowScriptAccess attribute ignored?

Question

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet:

<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>

Since the SVG is not loaded as picture, but instead as "embed", its JavaScript content is executed.

I have two questions:

1) Is there a way to disable JavaScript? If I replace "always" with "never", it still executes the JavaScript.

2) I would like to give trusted users the ability to include HTML content to an internal website. I want to give them a lot of freedom, like adding pictures, inserting YouTube videos, maybe even Google Maps iframes and stuff, as long as they don't execute JavaScript. But if I would give them access to the HTML "embed" tags, do I need to worry about JavaScripts/XSS execution?

Answer 1

I believe, the attribute AllowScriptAccess only works in context of Flash-Objects, as referenced here. It does not appear to be part of the embed-tag definition, as these links suggest.

Therefore my answer would be:

1. No. Not in an embed-tag.
2. Yes. I would disallow the embed-tag to secure your application.

As suggested in this answer you could also consider to use a different domain for the user content and let the same origin policy aid you.