SVG files do not fetch external CSS stylesheets when embedded in the DOM

Take a look at this example on jsFiddle.
When using IE, the external CSS is loaded and the rectangle is red, but in Chrome and FF the rectangle stays black.

What causes this difference?

<!-- Used for referencing the external css -->
<?xml-stylesheet href="mystyle.css" type="text/css"?>

Answer №1

When using SVG in an image context, such as within an html 'tag or as a CSS background image, it is essential that it remains complete within a single file to avoid any privacy leaks.

By switching the CSS include from an external file to an internal data URL, you'll notice that it functions properly in Chrome and Firefox. Understanding SVG's capabilities as being similar to raster images can help guide your approach, as raster images are also contained within a single file.

Imagine a scenario where a forum permits the use of SVG images for avatars. If external loading is permitted, a malicious user could potentially upload an SVG file that includes

<image xlink:href="http://evilhacker.com/myimage.png">
. If they have control over evilhacker.com, they could engage in various activities including:

  • Receiving a ping at their domain whenever someone views their profile (and logging the viewer's IP address)
  • Serving different avatar appearances based on factors like IP address or request headers
  • Changing their avatar's appearance at will, potentially shifting it to NSFW content after it has been approved by forum administrators

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

Differentiating the appearance of an HTML datalist with color alterations

Is there a way to customize the color of the datalist element (black box shown in the image)? https://i.stack.imgur.com/GGJQ3.png https://www.w3schools.com/tags/tryit.asp?filename=tryhtml5_datalist EDIT: The default color is set by the system, although ...

What could be causing the NoScript tag to malfunction across different web browsers?

I've incorporated the NoScript tag into my JSP pages in the head section. To avoid conflicts with tiles, I made sure not to include multiple NoScript tags. However, I am experiencing issues in Internet Explorer where it doesn't seem to be working ...

How can we develop play buttons for Facebook timelines similar to those found on Spotify?

Is it possible to create an HTML5 player that can be embedded on Facebook timelines, similar to the way Spotify has special privileges as a Facebook partner? I'm looking to provide a list of play buttons that, when clicked, will play songs sequentiall ...

Developing a Form Submission Feature Using JQuery Mobile

I'm having trouble submitting a form using JQuery Mobile. Currently, my code looks like this: <form action="#pagetwo" method="post" name="myform"> <input type="text" name="myname"> <input type="submit" value="submit" /> ... and th ...

The Jquery navigation and image display features are experiencing technical difficulties in Internet Explorer

My website is currently in the development stage and functions well on all browsers except for IE10. Interestingly, both the menu bar and photo gallery, which rely on Jquery, are not functioning properly in IE10. Below is the code snippet: <script ty ...

The hamburger symbol (&#9776;) appears as a dull shade on Android screens

Imagine a basic website design featuring a gray background with white text. <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8> </head> <body style="background: gray; color: white; font-size:50px;" > The t ...

Problem encountered with a selection menu

I'm experiencing some trouble with the dropdown menu. Whenever I try to move the mouse to access the dropdown menu, it seems unresponsive. I attempted adjusting the padding on a line of code but ended up moving the entire line instead. Here is the cod ...

Central AJAX spinner

I am having trouble centering the ajax loader. Currently, it is appearing in the right corner of the screen instead. Any help is appreciated. Below you can find the code snippet: div.amshopby-overlay { background-color: #fafafa; height: 100%; ...

Ways to incorporate a tertiary tier in my CSS dropdown navigation

I currently have a CSS code that displays a two-level menu, but I'm looking to expand it to include a third level. Unfortunately, I'm stuck and unsure of what changes to make in the CSS. Below is the existing code: #topnav{ // Existing CSS p ...

How come setting an optionsValue causes Knockout updating to malfunction?

As I delved into the Knockout tutorials, one particular tutorial caught my attention. Here is the HTML snippet that puzzled me: <h2>Your seat reservations</h2> <table> <thead><tr> <th>Passenger name</th& ...

Why isn't my heading showing up as expected in my document?

Can anyone help me understand why my title appears so low on certain screens? I've previously tried removing the negative margin when the title was hidden, but now it's positioned too far down. Here is the link to my webpage: ...

Rotating a CSS div causes the page to scroll horizontally

Currently, I am working on creating a unique design for the footer of my website. However, when implementing it, I encountered an issue that is causing a horizontal scroll (red background added for clarity). https://i.sstatic.net/K4vnV.jpg To address thi ...

Generate rows based on the quantity of items in Django templates

My current goal is: To create a <div class="row-fluid center"> and only display a maximum of 3 elements from list.dias.all. However, I am struggling to come up with the correct code. <div class="row-fluid center" id="{{list.dias.all.count ...

Insert title into PDF document

I am currently working on a react application that generates PDF documents easily. The libraries I have utilized are: jspdf html2canvas Below is the code snippet that demonstrates my approach: index.js: <div className="App"> < ...

I am faced with the puzzling situation where the value of my input type slider is displayed below the slider

I am currently working with HTML code that allows users to select a percentage using an input type range. Here is the code snippet I am using: <div class="container-fluid"> <div class="row"> <div class="c ...

My navigation bar's CSS code falls short of extending across the full width of my screen, leaving a gap of approximately 10 pixels before reaching the edges

Can someone help me figure out what went wrong? I've been trying to remove the margins but it's not working. The background colors of other elements seem to be seeping into this empty space. Any thoughts or suggestions would be greatly appreciate ...

Creating a notification system similar to Facebook's in an HTML button using just HTML and CSS

I'm attempting to create a button with a notification feature that mimics the style of Facebook notifications. I want a small red circle in the top right corner, showing a numerical value. However, I'm running into some difficulties. I can' ...

The text on my website is experiencing a cropping issue on the right side

I'm having an issue where the right side of all the text on my website is being cut off. I've tried using Firebug to inspect the element, but it's always a paragraph text and they have different parent divs. I'm not sure what CSS adjust ...

I want to create CSS columns that stretch to the full height of the window, positioned between a header and a footer, while also

I am looking to create a basic HTML layout with CSS that includes a header and two columns. The right column should have a fixed width of 100px, while the left column may have varying content lengths. I want both columns to stretch to the footer. Below is ...

Retrieving Multiple Arrays of Variables in PHP Output

I am struggling to retrieve the GET Variables from the URL of this particular page. Here is the URL: http://thisthat.com/category/?field_issue_month_value%5Bvalue%5D%5Byear%5D=2013&field_issue_month_value%5Bvalue%5D%5Bmonth%5D=10 I am attempting to ...