Re: Have you ever thought about security issues?

> Inkscape gets that part of the standard partly right: it at least
> refuses to render circular references; in general they do not cause
> harm (if you can find some cases where it does, please let us know).Well, 
> at least the version I have (v4.1) just gets into an infinite loop and 
> doesn't respond. I don't think it's correct.

Anyway, there's a choice if you control the level of recursion (and it's a 
must IMO). You can report an error and stop, or you can keep rendering until 
some level of recursion is exceeded. I don't see any other elegant way of 
detecting the loops, because they can have any level of indirection (a 
pattern refers to another pattern that refers to another pattern, etc... and 
the first pattern refers to the first one).
BTW, is that legal to have *nested* patterns/markers at all in SVG? I think 
it should be, but some agents don't do that. For example, FireFox SVG 
doesn't draw nested markers (it doesn't draw patterns at all, though).

McSeem

Received on Friday, 11 November 2005 16:41:45 UTC