SVG

How to look at an SVG without running it

An SVG is not a picture in the way a PNG is a picture. It is a text document that describes a picture, and the format lets it carry a good deal besides — including code. Whether any of that code runs depends entirely on how you open the file, which is the part most advice leaves out.

Foretaste opens an SVG as a drawing and as text, side by side, and it draws it in a frame that is refused scripting - so the picture is on screen and anything the file carries besides a picture is inert and readable rather than running.

Add to Chrome, free Or Edge Or Firefox

What is actually inside an SVG

Open one in a text editor and you get XML: elements with coordinates, a <rect>, a <circle>, some <path> data. That is the whole of most SVG files and there is nothing remarkable about them.

The format also permits, in the same file:

a <script> element, containing JavaScript;
event-handler attributes on ordinary elements — onload, onerror, onclick — which are code without looking like it;
CSS, including rules that fetch things;
references to other files: an <image> pointing at a URL, an embedded font, another SVG;
links, including javascript: ones.

None of that is a flaw in the format. SVG was designed to be a live document on a web page, and interactive charts depend on exactly these capabilities. It does mean that "it is only an image" is the wrong mental model when the file arrived from somewhere you did not expect.

What runs depends on how you open it

This is the useful part, and it is true whether or not you ever install anything. The same SVG behaves differently in three situations:

Navigating a browser tab to it — double-clicking the downloaded file, or following the link — renders it as a document. A document runs its scripts.
Putting it in an ordinary <img> element draws it as an image. Browsers do not run scripts inside an image, and do not follow references out of one. This is why an SVG on a web page is not the same risk as an SVG you opened yourself.
Opening it in a text editor shows you the markup and runs nothing at all. This is the advice most security write-ups end on, and it is correct — it is just an awkward way to find out what a logo looks like.

So the question is not really "is this SVG safe". It is "can I see the picture without putting the file in the one situation that executes it".

What Foretaste does with one

Right-click the link and choose Open with Foretaste. The file is fetched and its markup is put inside a frame that is granted no scripting and no origin of its own. Above the picture is a line saying so, because a property of the frame that nobody can see is not much use to a reader.

Three things follow from that frame, and they are mechanical rather than a judgement:

A <script> has nothing to run in. The frame is not granted script execution, so the element is inert. The same applies to an onload or onerror attribute, which is the half people forget.
The frame has no origin, so even if something did execute there is no page, no cookie and no storage of yours for it to reach.
Links are rewritten before the markup gets there. An ordinary web address opens in a new tab if you press it. A javascript: address has its href removed and the text left in place, marked so it does not read as a link that silently does nothing.

That last rule is one function used by every format Foretaste renders as HTML, and a check in the build fails the release if any frame holding somebody else's document is ever granted scripting. The test fixture used while developing it is an SVG carrying both a <script> and an onerror, on purpose.

The thumbnails on the page scan take the other route described above: they draw an SVG through an <img>, which neither runs scripts nor fetches what the file points at.

What this does not tell you

Worth being exact about, because a page like this is easy to over-read.

It does not tell you the file is safe, and Foretaste never says that about anything. What it tells you is that nothing in that document ran, because the frame it was drawn in cannot run anything. The file itself is untouched and unchanged.
It is not a virus scanner and does not look for anything. It draws what the file describes.
A reference out of the file can still be fetched. An SVG that points an <image> at a remote address is asking the browser for that address, and drawing the file is enough to make that request happen. Nothing about you is attached to it, but it is a request, and it is the one thing on this page that drawing does not prevent.
It does not show you the markup. Foretaste draws the picture; it is not a source viewer. If reading the XML is what you want, a text editor is still the right tool.
Saving it changes nothing about the file. A file you save to disk and later open by double-clicking is back in the first situation described above.

The related question — whether the thing you are looking at is even an SVG — is answered by reading its first bytes, which is a different check and has the same rule: it says what a file is and never says whether it is safe.

The questions people ask

Can an SVG file contain a script?

Yes. An SVG is XML rather than a grid of pixels, and the format allows a script element, event-handler attributes such as onload and onerror, CSS, and references to other files. That is what makes SVG useful for interactive graphics on a web page, and it is also why an SVG attachment is not the same kind of object as a PNG.

Does opening an SVG in a browser run the code in it?

It depends on how it is opened. Navigating a browser tab to an SVG renders it as a document, and a document runs its scripts. The same file placed in an ordinary img element does not: browsers do not run scripts in an image. Opening it in a text editor shows you the markup and runs nothing.

How does Foretaste show an SVG?

It fetches the file, then renders the markup inside an iframe that is granted no scripting and no origin of its own. With no allow-scripts there is nothing for a script element or an onload attribute to execute in, and a javascript: link has its address removed before the markup reaches the frame. A note above the picture says scripting is switched off.

Does that make the file safe?

No, and Foretaste never says a file is safe. What it says is narrower and checkable: nothing in that document executed, because the frame it was drawn in cannot execute anything. The file is unchanged, it is still whatever it was, and if you save it to disk and open it another way, the ordinary rules apply again.