THE WOES OF SANITIZING SVGS

Summary from the TLDR Dev newsletter

Scratch's reliance on complex, manual sanitization for directly embedded user-generated SVGs has proven unsustainable, repeatedly failing to prevent vulnerabilities like XSS and HTTP leaks. There are other alternatives that successfully sandbox SVGs within an `iframe` using a strict Content Security Policy.