Script inside SVG? [LWN.net]

Script inside SVG?

Posted Apr 17, 2025 10:51 UTC (Thu) by epa (subscriber, #39769)
In reply to: Script inside SVG? by excors
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp

I wonder about a mode that lets pages load external Javascript from a single, fixed directory, but forbids or severely restricts inline <script> elements.

to post comments

Script inside SVG?

Posted Apr 17, 2025 12:13 UTC (Thu) by excors (subscriber, #95769) [Link]

Sounds like you want Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP), where a page's HTTP header or <meta> element can restrict the page to only load scripts from a specific origin (domain), disable inline scripts and event handlers, only allow scripts with specific hashes, only allow <script>s with a server-generated nonce (which is what the Yelp patch does), etc.

It's explicitly "not intended as a first line of defense against content injection vulnerabilities" but it "reduces the harm that a malicious injection can cause" (https://www.w3.org/TR/CSP3/)