4

This SE question (now deleted, so not easily viewed) contains an animated SVG that loads from a private website instead of the usual GIF's hosted by imgur. The line is:

![https://www.moonwards.com/img/animations/transfer_time.svg][1]

  [1]: https://www.moonwards.com/img/animations/transfer_time.svg

Can the website start collecting SE users' and viewers' IP addresses this way? Are there other potential problems?

I've looked at the answers to I received a suspicious SVG file via Facebook message. What does it do? but I'm not sure how that applies here.

uhoh
  • 1,415
  • 2
  • 11
  • 21
  • Your linked question is unavailable to me. Could you link one that's not deleted? – Arminius Sep 05 '17 at 20:35
  • @Arminius the post was just deleted. That means that is invisible to users below a certain reputation level. The `.svg` in question should still be available from the line taken from the post that I've included as a code block in the question. My question is about svg's in general, and that one is one example. – uhoh Sep 05 '17 at 20:41

1 Answers1

7

Can the website start collecting SE users' and viewers' IP addresses this way?

Yes. Hotlinking embedded images is a feature on SE which has been criticized by users in the past. In your example, every visitor of the question page also involuntarily issues a request to the remote SVG image in the background. This way, everyone viewing the question reveals their IP address, user agent string, referrer and other browser details to the - potentially untrusted - third-party host.

Are there other potential problems?

  • Usually, SVG documents are capable of delivering active script content. So, allowing users of your website unrestricted upload of SVG images would potentially create a persistent XSS threat. However, when an SVG file is embedded as <img src=...>, as done on SE, the browser blocks it from executing any client-side code. Therefore, SVGs effectively don't pose a bigger threat here than hotlinking GIF or JPEG images.

  • Another negative effect of hotlinking is that the third-party host could decide to silently replace the image with advertisement or other inappropriate content at any time. (You can find some real-life examples here.)

  • Specially-crafted SVG files can be used to exhaust your memory. This is known as the billion laughs attack. As a mild DoS attack, it's more of an annoyance than a serious threat, though.

  • In some browsers it's still possible to conduct advanced phishing attacks by presenting a HTTP Basic Auth dialog for hotlinked images.


I'm strongly in favor of SE enforcing that all embedded images are hosted on a trusted, reliable CDN (e.g. Imgur, as already done with direct uploads). The community rightfully requires text sources to be quoted in case a link becomes unavailable. So it would be only logical to also preserve images in case the image host goes offline. (However, there might be legal implications of automatically re-uploading copyrighted images in a CDN.)

Arminius
  • 44,242
  • 14
  • 143
  • 138
  • 1
    Creator of said suspicious post here. Imgur does not support SVG uploads, and even if they implemented it, probably not animated SMIL. That is my only reason for not using the official CDN in this case. – SE - stop firing the good guys Sep 05 '17 at 21:20
  • 1
    @Hohmannfan I actually just had the same thought that SVGs might just not be supported and this was done for practical reasons. Also, I didn't mean to frame your post as "suspicious". I'm just outlining the possible risks, as requested by the asker. :) – Arminius Sep 05 '17 at 21:24
  • But it *is* suspicious. A person first looking up the combination of js and svg should imidiately be alarmed of the potential for XSS. It takes quite a bit more research to find out why it is safe (or the cases where it is *not* safe). Looks like we are still stuck with a 1987 stacked bitmap technology for animations. – SE - stop firing the good guys Sep 05 '17 at 21:31
  • @Hohmannfan: At this point, we could [almost](https://caniuse.com/#feat=apng) get away with a wholesale transition from GIF to APNG... but HTML5 video tags are probably a more viable alternative at this point. – Kevin Dec 28 '17 at 17:36
  • Video tags cannot be downloaded and opened in image viewers. – forest Mar 27 '18 at 02:39