0

Refactoring a website to be compatible with "safest" setting, but wasn't able to find documentation of this feature.

Edit: Found how... about:config => svg.disabled => true.

3
  • Please don't add an answer to your question. Instead add it as anwer.
    – Jens Kubieziel
    Apr 7, 2021 at 20:17
  • Thanks for the feedback @JensKubieziel... that being said, I don't understand... First you recommended not adding an answer and then to "add it as answer". Puzzled.
    – sunknudsen
    Apr 8, 2021 at 13:22
  • @sunknudsen, he meant posting the solution as an answer.
    – Swangie
    Apr 15, 2021 at 23:46

2 Answers 2

1

How the Tor browser disables SVG images:

The Tor browser design and implementation document states for the high security preference:

This security level inherits the preferences from the Medium level, and additionally disables remote fonts (noscript.forbidFonts), completely disables JavaScript (by unsetting noscript.globalHttpsWhitelist), and disables SVG images (svg.in-content.enabled).

However, I have reason to believe this is false and this document is not up to date.

The Tor Browser now disables SVG images by setting svg.disabled to true. I verified this to be the case when I checked the status of svg.disabled. It showed up as true for safest security level and false for any other security level.


Why the Tor browser does this:

SVGs create vulnerabilities including XSS attacks (Cross-Site-Scripting), HTML injection, The Billion Laughs Attack, DOS attacks, etc.

See more here:

0

Figured out why... see https://www.fortinet.com/blog/threat-research/scalable-vector-graphics-attack-surface-anatomy.

In a nutshell, SVGs add a lot of attack surface including scripting and injection attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .