Hacker News Reader

Comment by legulere | Hacker News Reader

And this is why you cannot easily host arbitrary user-uploaded SVGs on your website. One of the reasons why svgs are not as ubiquitous as png or jpg.

View on HN

The SVG is embedded using an iframe tag, so JS can run and mess with its DOM. SVG in an img tag can't run JS, as with jpgs or pngs. https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_I...

This definitely seems like something you shouldn't rely on and may change in the future (either due to browser bugs, actual shift in policy, or browser differences)

As someone else commented, the spec doesn't just omit running scripts via img tags, it explicitly excludes it, both the general idea of img being scriptable or interactive, and scripted SVG specifically (in the Note: part): https://dev.w3.org/html5/spec-preview/the-img-element.html#a...

I think the spec authors and browser vendors are more than savvy enough to know that "img tags don't run scripts" is a security-relevant promise that authors will rely on; I'm not so convinced it's uniquely unreliable compared to the many other security-relevant corner cases out there.

There are other reasons to treat user-provided content specially, whatever format, so maybe you end up in a similar place no matter what. I just don't want folks to be left thinking that the behavior here is unspecified or such.

But as someone else found out, if you choose "View Image", then the SVG's JS will run.

(For the record, since another site could cause XSS by iframing the same .svg you loaded in an img tag, yes, definitely don't host random SVGs on your domain. Wish I'd thought of that in my earlier message.)

Another reason is that you can recursively define shapes in SVGs and many browsers will happily keep rendering until they run out of memory.

WARNING: MIGHT FREEZE YOUR BROWSER/OS. CLICK AT YOUR OWN RISK. https://983.github.io/website/random/slow_1.svg

Browser makers still don't seem to understand that they are developing a new OS, where resource management and defending resources from possibly malicious 3rd parties is their core business. It's incredible that we have no way to limit memory and CPU consumption, or that browser doesn't do that automatically.

EDIT: interesting, your link made FF sweat, but it didn't stop working when I closed the tab - I had to manually kill the offending process.

I fully agree. Imagine my surprise when I was searching the issue trackers for Chromium and Firefox and found that apparently it is fine that SVGs can crash/lock up your browser or even your computer.

It took the actual OS makers decades to realise the same thing.

.. and just as they were starting to wise up, they decided they wanted to write a browser instead.

Insane.

Never host arbitrary user-uploaded files on your site. Put them in a sandboxed domain (e.g. per-user-random-string.<yourdomain>-userdata.com).

Being able to upload arbitrary files has enabled many many web security bypasses, with the result ranging from xss to csrf.

Wonder if you could sanitize it. Drop script tags?

SVGO has a option to drop script tags, thought it's not enabled by default.

Browsers will ignore scripts if you load the SVG in a img element.

Reply on news.ycombinator.com