bert hubert 🇺🇦🇪🇺 on Nostr: And another unfortunate security thing I learned today is that .svg files can contain ...
And another unfortunate security thing I learned today is that .svg files can contain JavaScript, and that your browser will happily execute that if someone directly views your image (so not through <img>). This has consequences for anyone hosting user supplied images. Thank you Wander Nauta for pointing this out. The painful story is here:
https://github.com/berthubert/trifecta/issues/38Published at
2024-01-19 12:47:53Event JSON
{
"id": "57e9a5c695aa8cf353b1c9078facff561a87020f79eb2aec8d4c8b39bdab823b",
"pubkey": "b2a729af72f53eaf7a64944a3b4fcc1a5c4e4476852b80513bf405183c484187",
"created_at": 1705668473,
"kind": 1,
"tags": [
[
"proxy",
"https://fosstodon.org/users/bert_hubert/statuses/111782689096895489",
"activitypub"
]
],
"content": "And another unfortunate security thing I learned today is that .svg files can contain JavaScript, and that your browser will happily execute that if someone directly views your image (so not through \u003cimg\u003e). This has consequences for anyone hosting user supplied images. Thank you Wander Nauta for pointing this out. The painful story is here: https://github.com/berthubert/trifecta/issues/38",
"sig": "abcc1f06a40eed8a1ba02f077db069fd2ed4d8980dc608a13d882c6b3df8b96c7b1e9d03fc7cc4af6da914f159e524c0fd7f96065a79be4e5d8333fb34ac54ba"
}
