W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2014

Re: img-src and inline <svg>

From: Glenn Adams <glenn@skynav.com>
Date: Sun, 27 Jul 2014 10:37:01 -0400
Message-ID: <CACQ=j+fOC__cqqthk4AYXvGk0H4sfL=R30yM_P2f2Hvyr-QykQ@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Brad Hill <hillbrad@gmail.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>
On Sun, Jul 27, 2014 at 7:12 AM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Fri, Jul 25, 2014 at 9:53 PM, Brad Hill <hillbrad@gmail.com> wrote:
> > Should we require 'unsafe-inline' in img-src to allow inline SVG to be
> rendered?
>
> No.
>
> Inline SVG is no different from HTML. The "3.6 Policy applicability"
> section is super confusing I think when it comes to how all these
> things fit together. "Inline" SVG is completely different from <img
> src=svg> or HTML fetched through XMLHttpRequest.
>

I agree with Anne.


>
>
> --
> http://annevankesteren.nl/
>
>
Received on Sunday, 27 July 2014 14:37:49 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:06 UTC