Script inside SVG?
Script inside SVG?
Posted Apr 17, 2025 16:51 UTC (Thu) by sfeam (subscriber, #2841)In reply to: Script inside SVG? by excors
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp
I have nothing to say about yelp per se. However I think you and the parent comment are underestimating the usefulness of SVG as a component of help files or browser-accessible documentation.
For example here is an on-line copy of gnuplot's User Manual . It uses svg for the figures (drill down through the sections under "plotting styles"). These particular figures are not interactive; they are embedded as you suggest with the tag <img src="example.svg">. However the corresponding demo pages, for example 2D hypertext demo and 3D hypertext demo are interactive, with the express purpose of showing how javascript can be used in conjunction with the pre-generated figures to allow a subset of the additional power to explore the data that you could get in a true interactive session.
Posted Apr 17, 2025 18:30 UTC (Thu)
by excors (subscriber, #95769)
[Link] (2 responses)
On plots with a large number of data points, SVG has noticeably poor performance - e.g. https://gnuplot.sourceforge.net/demo_svg_6.1/isosurface.html (SVG) takes over a second to render on my PC, whereas https://gnuplot.sourceforge.net/demo_canvas_6.1/isosurfac... (canvas) renders 10x faster (according to Firefox's profiler). DOM and CSS are a very inefficient way to draw ten thousand dots and lines.
I agree that interactive graphics are very useful in documentation and on the web, so I didn't mean to dismiss that use case - I just think SVG is generally a poor technology for that and there are better options.
(I suspect the fundamental issue is that interactive SVG is a retained-mode graphics API, and there's no way to make one of those that is universal, because applications have such widely varying requirements. Some want automatic hit-testing of every shape in the scene, others want to draw a million little dots; some want to animate a few parameters, others want to completely change the entire scene from one frame to the next; etc. You can't satisfy them all with the same API and the same graphics architecture.
But you can satisfy most of them with a lower-level immediate-mode graphics API, like <canvas> or WebGL, plus a range of scene graph libraries (third-party or application-specific) on top of that, so developers can choose appropriate tradeoffs between features and performance and complexity.
Also there's no need for interoperability between different applications' scene graphs, so there's no need for a bureaucratic standards process and all the technical compromises that result from it. Standardisation is worthwhile for a static image format, so it's good that SVG achieved that, but the problem is when SVG tries to go way beyond that.)
Posted Apr 17, 2025 20:20 UTC (Thu)
by sfeam (subscriber, #2841)
[Link]
Well yes. but so far as I know the HTML/canvas representation isn't useful for anything other than being viewed in a web browser. The svg representation is still a reasonably portable figure even when detached from its interactive js parts, and can easily be edited or modified by other tools. FWIW I have used the svg-based tool Inkscape for many years now for creating technical figures. Being able to start from, edit, or include, svg figures from gnuplot is a big plus.
Posted Apr 19, 2025 2:15 UTC (Sat)
by notriddle (subscriber, #130608)
[Link]
Script inside SVG?
"You don't need SVG for that though, you can use HTML <canvas> + JS instead"Script inside SVG?
As an example, the flamegraph reference implementation generates SVG files with embedded JS. You can see the chart even in non-interactive renderers like librsvg, but in a browser you can click a column to zoom in on it.
Script inside SVG?