SVG: Exploiting Browsers without Image Parsing Bugs
summary
Shows concrete SVG pitfalls and browser behaviour: test files and a Node.js server demonstrate that Internet Explorer applies external stylesheets and even loads nested images in static image contexts, Chrome sometimes loads cross‑origin stylesheets and lets a recursion loop run ~241 iterations (or up to ~1,000 on bigger machines) before crashing while IE runs in excess of 4,000 iterations and a server-driven version exceeds quarter million iterations. Content Security Policy handling is inconsistent — Chrome misapplies CSP to inline CSS and treats object source and frame source incorrectly.
AI-written summary · about
chapters (8)
- 0:00SVG overview and security
- 1:32SVG usage in web documents
- 2:42Advanced SVG features
- 4:49SVG attack vectors
- 8:23Browser security models
- 11:05Recursive SVG vulnerabilities
- 15:05Content Security Policy (CSP)
- 19:58Best practices and conclusions
