SVG Paint Servers Can Reach Beyond the Shape They Fill
SVG Paint Servers Can Reach Beyond the Shape They Fill An SVG fill or stroke can point to a paint server instead of a color. Gradients, patterns, and other paint content may live in the same document or be referenced a
SVG Paint Servers Can Reach Beyond the Shape They Fill
An SVG fill or stroke can point to a paint server instead of a color. Gradients, patterns, and other paint content may live in the same document or be referenced as an external resource. That makes a visual attribute part of a document's resource-loading graph.
The W3C's SVG security guidance notes that stylesheets and other features in SVG can reference external resources. SVG 2 gives user agents processing modes that control animations, external references, scripting, and interaction. When SVG is loaded through use references or paint-server cross-references, the specification requires processing in secure static mode. Those requirements are easy to miss when an application treats an SVG file as an ordinary image blob.
The document is the boundary
A paint server is not merely a list of colors. SVG 2 describes templates and indirect references, and it allows security limits on external files to invalidate a reference. A user agent may treat an external file request as a security error. The application should not build a renderer that ignores those limits or substitutes its own unrestricted fetch path.
The base element is another point of indirection. It can change the meaning of URL values, including paint-server and element references. A sanitizer that preserves base while removing scripts has not necessarily made later resource resolution safe. The same caution applies to relative URLs, redirects, fragments, and data URLs.
For this reason, render untrusted SVG in a constrained mode. Prefer rasterization or a dedicated SVG renderer that does not execute scripts and does not fetch external resources. If the browser must display the SVG, serve it from an isolated origin and apply a restrictive Content Security Policy. An inline SVG shares the page's origin and DOM; it deserves a stronger review than a separate image response.
Sanitize the tree, not the markup string
Use an XML-aware parser when the input is SVG. Preserve namespaces and reject unsupported ones. Resolve URL-valued attributes against a policy before the renderer sees them. Remove script, event attributes, animation that can change resource references, and foreign HTML or MathML content unless the product explicitly supports it.
Do not assume that removing a <script> element makes the document inert. A paint server can reference another document; a <use> reference can clone content; an animation can change a property that selects a resource. SVG's processing model treats these as parts of the document, not as harmless presentation details.
Operational checks
Inventory where SVG is accepted: user avatars, document previews, diagram exports, email attachments, report templates, and generated charts. For each path, record the parser, the renderer, the allowed namespaces, and the external-resource policy. Test an SVG with a remote paint reference, a base element, a redirecting URL, and a data URL. Confirm that the final renderer refuses the fetch or renders a broken reference instead of contacting the network.
Generated SVG deserves the same treatment as uploaded SVG. A charting library that accepts user labels, colors, or templates can produce markup that is later processed by a different component. The safest design keeps resource URLs out of the data model and resolves only server-approved assets after the template has been parsed.
SVG is useful because it can express complex graphics with a small amount of text. That same compactness hides a document model with links, references, animation, and processing modes. Treating paint servers as a styling detail leaves a resource-loading path outside the security review.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.