This is not entirely correct. An SVG file embedded in an <iframe> or <object> is... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

felixfbecker on Dec 9, 2020 | parent | context | favorite | on: CSS in GitHub Readmes

This is not entirely correct. An SVG file embedded in an <iframe> or <object> is a document itself, and if cross-origin, can not access the outer document. However, if not in a sandboxed iframe, it can still do things like trigger alert prompts or navigation.

eyelidlessness on Dec 9, 2020 [–]

Sorry, this is right. I should have said it’s just as capable or limited in SVG as a bare script tag in the same place.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact