TLDR Tech / Dev
The woes of sanitizing SVGs
Scratch's reliance on complex, manual sanitization for directly embedded user-generated SVGs has proven unsustainable, repeatedly failing to prevent vulnerabilities like XSS and HTTP leaks. There are other alternatives that successfully sandbox SVGs within an `iframe` using a strict Content Security Policy.
Read the full story