How hard is it to process untrusted SVG data to strip out any potentially harmful tags or attributes (like stuff that might execute JavaScript)?

[freddy@social.security.plumbing]

@simon @jaffathecake if you just want the SVG displayed, put them in an <img> tag. Otherwise, your favorite sanitizer library DOMPurify has great SVG support. (Iframe sandbox works really great too!!)

[jaffathecake@mastodon.social]

@freddy @simon a sandboxed iframe means you can allow scripting in an opaque origin

[freddy@social.security.plumbing]

@jaffathecake @simon yes, totally. Dunno if Simon would want scripts in the images. If you want them, sandbox gives better controls. If you want to police the exact set of allowed elements, a sanitizer is even better.

But if all you want is to safely display them, img is really simple (don’t host the user supplied files on the same origin in either of these cases though :))

[simon@fedi.simonwillison.net]

@freddy @jaffathecake I think I can even get away with not serving the images from a separate domain if I instead inline them as base64 SVG in the img sec attribute

(Running off a separate domain is OK for me but makes things harder for my users if I release open source code for other people to self-host)