When using SVG in an image context, such as within an html 'tag or as a CSS background image, it is essential that it remains complete within a single file to avoid any privacy leaks.
By switching the CSS include from an external file to an internal data URL, you'll notice that it functions properly in Chrome and Firefox. Understanding SVG's capabilities as being similar to raster images can help guide your approach, as raster images are also contained within a single file.
Imagine a scenario where a forum permits the use of SVG images for avatars. If external loading is permitted, a malicious user could potentially upload an SVG file that includes
<image xlink:href="http://evilhacker.com/myimage.png">
. If they have control over evilhacker.com, they could engage in various activities including:
- Receiving a ping at their domain whenever someone views their profile (and logging the viewer's IP address)
- Serving different avatar appearances based on factors like IP address or request headers
- Changing their avatar's appearance at will, potentially shifting it to NSFW content after it has been approved by forum administrators