Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

We ended up mitigating by sanitising tags+attributes, and validating all xlink:href's in the SVG-XML, using a library like bleach (https://github.com/mozilla/bleach) before passing to ImageMagick.

Probably not a bad thing to be doing anyway.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: