Scalable Vector Grief
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A security researcher reports bypassing six of eight popular SVG sanitizer libraries, using techniques such as XHTML namespace switching, animated JavaScript URLs, XSLT stylesheets delivered via data URLs, a Link response header that triggers XSS in Firefox, and importing GIFs as SVG in Safari.