Script inside SVG?
Script inside SVG?
Posted Apr 17, 2025 12:13 UTC (Thu) by excors (subscriber, #95769)In reply to: Script inside SVG? by epa
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp
Sounds like you want Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP), where a page's HTTP header or <meta> element can restrict the page to only load scripts from a specific origin (domain), disable inline scripts and event handlers, only allow scripts with specific hashes, only allow <script>s with a server-generated nonce (which is what the Yelp patch does), etc.
It's explicitly "not intended as a first line of defense against content injection vulnerabilities" but it "reduces the harm that a malicious injection can cause" (https://www.w3.org/TR/CSP3/)