![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
![[site community profile]](https://www.dreamwidth.org/img/comm_staff.png){kind=small}
Entry tags:
Question thread #62
It's time for another question thread!
The rules:
- You may ask any dev-related question you have in a comment. (It doesn't even need to be about Dreamwidth, although if it involves a language/library/framework/database Dreamwidth doesn't use, you will probably get answers pointing that out and suggesting a better place to ask.)
- You may also answer any question, using the guidelines given in To Answer, Or Not To Answer and in this comment thread.
The rules:
- You may ask any dev-related question you have in a comment. (It doesn't even need to be about Dreamwidth, although if it involves a language/library/framework/database Dreamwidth doesn't use, you will probably get answers pointing that out and suggesting a better place to ask.)
- You may also answer any question, using the guidelines given in To Answer, Or Not To Answer and in this comment thread.
Re: SVG images
Re: SVG images
(Anonymous) 2018-03-28 08:22 pm (UTC)(link)I know there's an HTML cleaner that strips all HTML that can be abused. Would an SVG cleaner that passes only white-listed SVG elements be a substantial task? I know I don't use all that many different SVG elements for my vector images, even if we count all the headers and helpers that Inkscape adds as things I use.
Probably obvious, but:
Any kind of cleaner would have to be based on a white-list rather than a black-list, because a black-list can't reasonably be expected to strip every future element with abuse potential, while a white-list that strips safe elements can be updated if enough people are affected to be worth revising the white-list.
Re: SVG images
Re: SVG images
Re: SVG images
I found an article about SVG on Wordpress, explaining a little about the problems (which hadn't occurred to me, since I have only ever used the harmless parts of SVG). It points to a sanitizer that might be able to run on Dreamwidth, since it's Perl.
https://bjornjohansen.no/svg-in-wordpress
This is a PHP "sanitizer" for SVG, mentioned in the Wordpress article:
https://github.com/darylldoyle/svg-sanitizer
This is a Javascript santizer for HTML, MathML, and SVG, which was the basis for the PHP sanitizer:
https://github.com/cure53/DOMPurify
This is another PHP sanitizer, which is a lot simpler. That suggests that it's lighter on server load, and easier to validate, but also that it's more likely to reject non-malicious SVG:
https://github.com/alnorris/SVG-Sanitizer
Also, Mediawiki, using on Wikipedia and other Wikimedia sites, supports SVG. But in spite of some searching for how its SVG support works, all I could find is that the general information that it can serve SVG to users whose browsers can render it correctly, but normally it automatically converts to PNG for more consistent behavior between browsers.
One of the points about consistent rendering behavior is that if an SVG file includes text, but requests a font that isn't installed on the machine that does the rendering (the server if the server is automatically converting to PNG, or the client if it's delivering SVG directly), the results may not be as intended.
Wikipedia user documentation advises users who generate SVG images that include text that they should upload two versions: one that has all the text vectorized, and one that includes the native text, the latter so that other users can edit the images without trying to reverse engineer the vectorized text. It also includes a link to a long list of fonts that Wikimedia can correctly render, most of which apparently are somewhat obscure free alternatives to more familiar proprietary fonts.
Sorry I don't have links for the Mediawiki articles, but I bounced around a lot gathering that information, and lost track of where I found it all among the abundance of information scattered around on Wikimedia sites.
Re: SVG images
Hmm, reading up on your links a bit, I don't think we could be confident enough in the sanitizers, especially since images in entries can display in a lot of contexts (and with a lot of permissions) and therefore need strict scrutiny. But thank you so much for looking into it more and pointing me to the resources!
Re: SVG images
I'll keep looking, and if I can find something that avoids the abundant risks of SVG (even if at the cost of greatly narrowing the extent of what one can do with it) I'll follow up more.
Also, I came across a more limited vector format that might be a possibility, if I can find it again. That might offer another path to vector image support, particularly if there's a good way to save an SVG as the other format.
Re: SVG images