[Clipart] Malware in clipart
ocalocal at btinternet.com
Tue Mar 15 06:06:03 PST 2005
> > As far as I can tell, any SVG file with a script element must
> > contain "<script" or ":script" (or maybe ";script").
> They could not contain scripts in attributes, such as onclick,
> onmouseover, onmouseout, onmousedown, onmouseup, onfocus, onblur,
> onrollover, onload, onunload, et cetera, ad infinitum, ad bedlam?
Yes, I forgot that the scripts could be entirely contained in
attributes. There are 19 such attributes listed in the SVG spec.
I checked yesterday that none of these attributes are used in SVG
files in the current release. As before, this check was done
with grep, so it depends on the files being in UTF-8 (and Andrew
Archibald says that they can be hidden from grep anyway - I would
be interested to see how this can be done).
More information about the clipart