Hacker News new | ask | show | jobs
by albertgoeswoof 2565 days ago
How is this any different from hotlinking an image? I don't understand the security risk here? If a bad actor gets control of the domain all they can do is change the svg that you render.

I suppose you could parse that SVG in an insecure way (if for some reason you were parsing it) but that's not a problem with using the service.

1 comments

I agree that it's probably safe, but SVG can contain script tags.