Re: img-src and inline <svg>

On Sun, Jul 27, 2014 at 7:12 AM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Fri, Jul 25, 2014 at 9:53 PM, Brad Hill <hillbrad@gmail.com> wrote:
> > Should we require 'unsafe-inline' in img-src to allow inline SVG to be
> rendered?
>
> No.
>
> Inline SVG is no different from HTML. The "3.6 Policy applicability"
> section is super confusing I think when it comes to how all these
> things fit together. "Inline" SVG is completely different from <img
> src=svg> or HTML fetched through XMLHttpRequest.
>

I agree with Anne.


>
>
> --
> http://annevankesteren.nl/
>
>