Closed cliveb closed 4 years ago
We're sympathetic with your desire to employ SVG features within a wiki page. We've yet found a way to do so without exposing readers to malicious javascript.
Here is what we do have:
Sanitized HTML which will permit an tag to display SVG format files as inert images. In this case it is not our sanitizer (caja) that is removing the javascript threat, but the mechanisms within the image tag itself.
Graphviz markup where we require any drawing to pass through the venerable application first. We display the SVG it generates because we trust it to not pass malicious javascript. We attach our own javascript to this output in order to open new pages in the lineup when graph nodes are clicked.
Both @dobbs and David Bovill have experimented with adding a plugin that would display any SVG. They might have something that could work on a private site where they trust every page they show.
We fancied dropping animated SVG into our wiki page. We found the GraphViz plugin installed on our server instance and used it. Alas, svg image failed to render. We searched Fedwiki for the Graph Plugin and found we could fork a page and render svg fine. Yet when we create a new page using svg assets from the forked page the svg fails to render. We used chrome dev tools to inspect the page, and see the svg is available rendered, yet our new page fails with message:
test 1 new lottie svg 'error on line 1 at column 1: Extra content at the end of the document'
test 2 forked graph svg 'error on line 1 at column 1: Extra content at the end of the document'
test 3 simple svg test by FedWiki
syntax error in line 1 near 'Welcome'
Our wiki page: http://clive.tries.fed.wiki/view/lottie-svg-animations
Related to testing we found RawGit has reached the end of its useful life and replaced with jsDelivr See page ToDo http://clive.tries.fed.wiki/view/graph-plugin