[Clipart] Malware in clipart

[Stephen Silver]

Jonadab wrote:

> > As far as I can tell, any SVG file with a script element must
> > contain "<script" or ":script" (or maybe ";script").  
> 
> They could not contain scripts in attributes, such as onclick,
> onmouseover, onmouseout, onmousedown, onmouseup, onfocus, onblur,
> onrollover, onload, onunload, et cetera, ad infinitum, ad bedlam?

Yes, I forgot that the scripts could be entirely contained in
attributes.  There are 19 such attributes listed in the SVG spec.
I checked yesterday that none of these attributes are used in SVG
files in the current release.  As before, this check was done
with grep, so it depends on the files being in UTF-8 (and Andrew
Archibald says that they can be hidden from grep anyway - I would
be interested to see how this can be done).

-- 
Stephen Silver