Script inside SVG? [LWN.net]

Script inside SVG?

Posted Apr 16, 2025 19:16 UTC (Wed) by epa (subscriber, #39769)
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp

allowing us to use a <script> tag in a <svg> tag to inject arbitrary scripts.

Yikes, SVG can contain JavaScript? I'm sure this seemed like a good idea at the time and there might even, perhaps, be a legtimate use for it somewhere. But it seems like the kind of thing that should be disabled by default (in fact, I would say a help browser using HTML should have all JavaScript disabled). That would have blocked this exploit.

to post comments

Script inside SVG?

Posted Apr 16, 2025 21:13 UTC (Wed) by excors (subscriber, #95769) [Link] (13 responses)

I think the original idea was for SVG to be part of a system for interactive graphical applications on the web, competing with Flash. That requires scripting, and it made sense to integrate SVG with existing web technologies - JS, DOM, CSS, XML, XHTML, etc - rather than duplicate all that work. Even if there was no <svg:script>, with XML Namespaces and <foreignObject> you can put JS in XHTML in SVG in XHTML and modern browsers will execute it; the W3C wanted all their XML-based technologies to integrate like that.

It turned out nobody wanted to write interactive graphical applications using SVG, so it has just hung around as an overly-complex inefficient vector graphics file format, causing occasional problems when someone remembers its real capabilities.

Web browsers do disable scripting etc when you use <img src="example.svg">, so its security considerations in the <img> context are basically the same as JPEG, i.e. it's pretty safe. But it sounds like Yelp was using XSLT to transform a custom XML language into HTML, and that just copied SVG elements verbatim without any kind of allowlisting, which is about as dangerous as copying untrusted HTML verbatim.

Based on a cursory look at the code, I suspect Yelp may be equally vulnerable to script injection via MathML - it seems to copy those in the same way as it does SVG, and you can put:

<annotation-xml encoding="text/html"><script xmlns="http://www.w3.org/1999/xhtml">...

inside MathML and browsers will execute it (in both XML and HTML parsing modes; XML only needs the xmlns, HTML only needs the annotation-xml). So this is not really SVG's fault.

<script>s get executed in inline SVG

Posted Apr 16, 2025 23:15 UTC (Wed) by CChittleborough (subscriber, #60775) [Link]

I just tried the example from the SVG standard's specification of <script>, and it ran in the latest Firefox and Chrome. So I created a little HTML file containing that SVG, and the JavaScript still runs.

So <img src="example.svg"> is safe, but inline SVG will execute any <script> elements, including event handlers such as onload= attributes.

This is not relevant to the yelp problem, but is something more for long-suffering web developers to keep in mind ...

Script inside SVG?

Posted Apr 17, 2025 6:41 UTC (Thu) by epa (subscriber, #39769) [Link] (7 responses)

In my view copying HTML verbatim should not be dangerous *in a help browser*. Whatever it does with the HTML should involve displaying it, not executing any scripts.

It can check the HTML too, making sure it doesn't have <script> elements, to present a useful error message -- but that shouldn't be the only defence. The writeup notes: "Simply appending a script tag or a malicious on* attribute in the input XML document won't work since handling these tags is not defined in the yelp-xsl app." Which is great, but an oversight in the XSL processing shouldn't open the door to arbitrary scripting.

I think WebKitGtk needs a mode without any JavaScript support, and this should even be the default (since there are hundreds of little programs that just want to display some HTML in their splash screen or help text with a few lines of code, while writing a web browser is a less common task).

SVG mode needs to be SVG Tiny Portable/Secure

Posted Apr 17, 2025 9:35 UTC (Thu) by johnjones (guest, #5462) [Link]

the whole point is you can have a logo or drawing to explain but you dont need scripts and

https://datatracker.ietf.org/doc/html/draft-svg-tiny-ps-a...

Script inside SVG?

Posted Apr 17, 2025 9:40 UTC (Thu) by excors (subscriber, #95769) [Link] (4 responses)

One comment in the bug report says "We do use JavaScript in the HTML output for things like expandable sections. Disabling all JavaScript would break numerous features". It also uses MathJax for MathML rendering; apparently WebKit has reasonable native support for MathML nowadays, but not back in 2012 when Yelp added it. And it looks like there's highlight.js for syntax highlighting.

If WebKitGTK had a no-scripting mode, Yelp would probably have disabled that mode because scripting is very useful.

Script inside SVG?

Posted Apr 17, 2025 10:51 UTC (Thu) by epa (subscriber, #39769) [Link] (1 responses)

I wonder about a mode that lets pages load external Javascript from a single, fixed directory, but forbids or severely restricts inline <script> elements.

Script inside SVG?

Posted Apr 17, 2025 12:13 UTC (Thu) by excors (subscriber, #95769) [Link]

Sounds like you want Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP), where a page's HTTP header or <meta> element can restrict the page to only load scripts from a specific origin (domain), disable inline scripts and event handlers, only allow scripts with specific hashes, only allow <script>s with a server-generated nonce (which is what the Yelp patch does), etc.

It's explicitly "not intended as a first line of defense against content injection vulnerabilities" but it "reduces the harm that a malicious injection can cause" (https://www.w3.org/TR/CSP3/)

Script inside SVG?

Posted Apr 21, 2025 23:55 UTC (Mon) by NYKevin (subscriber, #129325) [Link]

You don't need JavaScript for expandable sections, that's just <details>. You probably do need some JavaScript for other forms of basic DOM manipulation (like syntax highlighting), but you almost certainly do not need it to have internet access (we're displaying help files from the local system, not the internet). The "obvious" solution is to dump Yelp inside of a Flatpak (or any Flatpak-like thing, like a Nix container, a Docker image, etc.), turn off its internet access, and call it a day. But that would be unacceptable to every distro that packages GNOME, so it will probably not be done as the official upstream fix (as entertaining as it might be to watch 50 different distros grapple with "you can't un-Flatpak it for security reasons" versus "you can't keep it in a Flatpak because Flatpak is evil").

I imagine there might be some cases where you try to load a Yelp document over HTTP(S) for legitimate reasons (e.g. because the help file is not installed locally), but I really hope that is not the case because Yelp is unmaintained (per the bug tracker) and should not be dealing with untrusted content from the internet. If they are not already planning to remove its internet capabilities outright, they should do that now.

Script inside SVG?

Posted Apr 23, 2025 6:20 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

AFAIK, WebKitGTK does support disabling JS: https://github.com/uzbl/uzbl/blob/master/src/variables.c#...

Script inside SVG?

Posted Apr 17, 2025 13:18 UTC (Thu) by mcatanzaro (subscriber, #93033) [Link]

There are two options to disable JavaScript: WebKitSettings:enable-javascript, which is a heavy hammer to turn it off completely, which applications often cannot use because they generally need to be able to run their own JavaScript, and also WebKitSettings:enable-javascript-markup, which disables all JavaScript embedded in documents but still allows applications to execute JavaScript themselves. WebKitSettings:enable-javascript-markup is generally what you want.

However, it seems Yelp does need to allow documents to execute certain approved scripts, so I guess it can't use either of these.

Script inside SVG?

Posted Apr 17, 2025 16:51 UTC (Thu) by sfeam (subscriber, #2841) [Link] (3 responses)

I have nothing to say about yelp per se. However I think you and the parent comment are underestimating the usefulness of SVG as a component of help files or browser-accessible documentation.

For example here is an on-line copy of gnuplot's User Manual . It uses svg for the figures (drill down through the sections under "plotting styles"). These particular figures are not interactive; they are embedded as you suggest with the tag <img src="example.svg">. However the corresponding demo pages, for example 2D hypertext demo and 3D hypertext demo are interactive, with the express purpose of showing how javascript can be used in conjunction with the pre-generated figures to allow a subset of the additional power to explore the data that you could get in a true interactive session.

Script inside SVG?

Posted Apr 17, 2025 18:30 UTC (Thu) by excors (subscriber, #95769) [Link] (2 responses)

You don't need SVG for that though, you can use HTML <canvas> + JS instead: https://gnuplot.sourceforge.net/demo_canvas_6.1/hypertext...

On plots with a large number of data points, SVG has noticeably poor performance - e.g. https://gnuplot.sourceforge.net/demo_svg_6.1/isosurface.html (SVG) takes over a second to render on my PC, whereas https://gnuplot.sourceforge.net/demo_canvas_6.1/isosurfac... (canvas) renders 10x faster (according to Firefox's profiler). DOM and CSS are a very inefficient way to draw ten thousand dots and lines.

I agree that interactive graphics are very useful in documentation and on the web, so I didn't mean to dismiss that use case - I just think SVG is generally a poor technology for that and there are better options.

(I suspect the fundamental issue is that interactive SVG is a retained-mode graphics API, and there's no way to make one of those that is universal, because applications have such widely varying requirements. Some want automatic hit-testing of every shape in the scene, others want to draw a million little dots; some want to animate a few parameters, others want to completely change the entire scene from one frame to the next; etc. You can't satisfy them all with the same API and the same graphics architecture.

But you can satisfy most of them with a lower-level immediate-mode graphics API, like <canvas> or WebGL, plus a range of scene graph libraries (third-party or application-specific) on top of that, so developers can choose appropriate tradeoffs between features and performance and complexity.

Also there's no need for interoperability between different applications' scene graphs, so there's no need for a bureaucratic standards process and all the technical compromises that result from it. Standardisation is worthwhile for a static image format, so it's good that SVG achieved that, but the problem is when SVG tries to go way beyond that.)

Script inside SVG?

Posted Apr 17, 2025 20:20 UTC (Thu) by sfeam (subscriber, #2841) [Link]

"You don't need SVG for that though, you can use HTML <canvas> + JS instead"

Well yes. but so far as I know the HTML/canvas representation isn't useful for anything other than being viewed in a web browser. The svg representation is still a reasonably portable figure even when detached from its interactive js parts, and can easily be edited or modified by other tools. FWIW I have used the svg-based tool Inkscape for many years now for creating technical figures. Being able to start from, edit, or include, svg figures from gnuplot is a big plus.

Script inside SVG?

Posted Apr 19, 2025 2:15 UTC (Sat) by notriddle (subscriber, #130608) [Link]

As an example, the flamegraph reference implementation generates SVG files with embedded JS. You can see the chart even in non-interactive renderers like librsvg, but in a browser you can click a column to zoom in on it.

Script inside SVG?

Posted Apr 17, 2025 7:06 UTC (Thu) by joib (subscriber, #8541) [Link]

Well, there is precedent for this kind of (mis?)feature, e.g. Postscript. Then the world switched over to PDF, where one of the advantages was that PDF isn't a full Turing complete language, and thus less scope for issues (exploits, or DOS'ing your printer with malformed Postscript, etc.). But of course, modern PDF also has support for embedded Javascript, so plus ça change..

Script inside SVG?

Posted Apr 17, 2025 12:46 UTC (Thu) by callegar (guest, #16148) [Link]

Isn't this needed in applications like e.g., sozi (https://sozi.baierouge.fr/pages/10-about.html) for e.g., interactive presentations?