Page MenuHomePhabricator

Allow Lua to generate interactive SVGs (<svg> instead of <img>)
Open, Needs TriagePublicFeature

Description

Scribunto recently added support for Lua to generate SVGs rendered as <img> in T405861. This renders SVGs in secure animated mode which allows declarative animations but not interactions. There are some use cases where interactivity would be helpful to illustrate article content.

This can be done by emitting <svg> elements to html, after passing them through a sanitizer to strip elements and attributes that could trigger external resource loads or script execution (T334953). The interface for this in Scribunto could be a new :toTag() method in mw.svg.

Previously discussed within T334372.

FeatureUnsanitized, as <img> (Supported)Sanitized, as <svg> (Proposed)
Declarative animationsYesYes
InteractivityNo, blocked by browserYes
Script executionNo, blocked by browserNo, blocked by MediaWiki
External referencesNo, blocked by browserNo, blocked by MediaWiki

Event Timeline

Change #1203874 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/Scribunto@master] Sanitize SVGs and allow embedding as <svg> tags in HTML

https://gerrit.wikimedia.org/r/1203874

Change #1203875 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/Scribunto@master] Support advanced elements and attributes in SVG sanitizer

https://gerrit.wikimedia.org/r/1203875