Web Security · Middle · Question 7 of 75
Users can upload SVG avatars that are served from your main domain. What's the risk?
- ✓Correct answer: SVG can contain scripts; opened directly, it runs on your origin as stored XSS
- 2SVG files are always larger than PNG, so the site gets slower
- 3Browsers refuse to display uploaded SVG files
Explanation
Serve uploads from a separate domain, sanitize or rasterize SVGs, and send Content-Disposition: attachment or a strict CSP for user files.