Scalable Vector Grief

13 points by buherator

serce

I wonder what it would take to create an SVG v2 that disallows all inline scripts, <foreignObject>, etc. Basically, everything that can cause XSS and similar issues.

masklinn

That was SVG Tiny 1.1, however 1.2 added scripting features back in, and that does not remove the attack vectors which are part of XML itself.
- singpolyma
  
  Or the attack vectors part of UTF8 etc
  
  Everything is vulnerable at some point