How can I securely render SVG documents in a media sharing application?
I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <iframe>
element, but I'm not sure the same-origin policy will catch something similar to <script>window.top.location = 'http://malic.io.us/pwnd'</script>
in the SVG.
I have not been able to find anything via web search. Do you have any canonical best practices or is this an underdeveloped corner of the web specifications?