[RSS Feed/News] Asset upload accepts SVG with JavaScript

[XenForo]

XenForo does accept SVG with embedded JavaScript like
Code:

<svg viewBox="0 0 390 82" xmlns="http://www.w3.org/2000/svg" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
    <script>
    <![CDATA[
    alert('Code executed!');
    ]]>
    </script>
    <path d="M27.05 40.777l10.368-16.752h9.81L31.445 46.936m-2.427 3.523l20.383 29.722h-9.81L24.729 57.508 9.81 80.181H0L20.383 50.81 2.115 24.025h9.868l12.746 20.501M59.772...

Read more

ادامه مطلب...