Conversation

Every ingredient in this bug is utter 💩 that should never have existed. Non-plaintext paste. JS in images. Some ridiculous <use> tag nesting markup. ...

Quote Tweet

Chromium Disclosed Security Bugs

@BugsChromium

Jul 7, 2020

Security: Another "universal" XSS via copy&paste (reward: $2000) crbug.com/1040755

Daniel Micay

@DanielMicay

Replying to

@RichFelker

SVG is really screwed up. It has a DOM and JavaScript like HTML. developer.android.com/reference/kotl is essentially an extreme simplification of SVG with only the very basics. It's from an earlier time when SVG was too bloated for mobile but now SVG is being used for most new things instead.

developer.android.com

VectorDrawable | Android Developers

6:32 AM · Jul 8, 2020Twitter Web App

Replying to

and

SVG supports CSS too. Can tell something is wrong when they had to make SVG Tiny and SVG Basic standards to make it less bloated for mobile. Most implementations of SVG only support a subset of the standards. I don't really think there are proper implementations outside browsers.

Replying to

Browsers should only implement the safe subset.

Show replies