Hacker News Reader

Comment by smartmic | Hacker News Reader

Tangentially, I learned a few days ago that any attribute that can contain a URI will be executed as javascript if the URI uses the javascript: key

For a list, see https://stackoverflow.com/questions/2725156/complete-list-of...

View on HN

This is true, but also so old that it is well known by now.

It can be blocked by CSP IIRC.

That SVG can execute Javascript also used to be well known, back when SVG was considered the future replacement to Flash. I even remember some websites that were just one handcrafted SVG. And browsers deciding not to execute these scripts when you load an SVG via an <img> tag was a big deal.

Of course SVG didn't become the Flash replacement everyone hoped for, so that knowledge seems to have become more obscure. The same probably happened to knowledge about javascript links after frameworks like react made event handlers the more convenient alternative.

Yeah I once went down the rabbit hole of googling SMIL and there's a nice example on Wikipedia of a live clock, right?

At the time, this example even worked on my phone, will have to check if that's still the case.

Generally, SVG reminds of PDF with its feature creep (foreign entities?)... but I feel web browsers are beating SVG into becoming a sane vector graphics format without such shenanigans.

SVG animation elements are now mostly supported by all modern browsers. You can even use `transform-origin` and `transform-box` CSS properties to control the origin point (this was a major pain point in the past). I think "paced" interpolation is the only important feature that is still missing.

Reply on news.ycombinator.com