Hacker News: inkmuffin

New comment by inkmuffin in "The woes of sanitizing SVGs"

inkmuffin — Tue, 28 Apr 2026 00:33:11 +0000

Since 2019, Scratch is written to run in a standard web browser, replacing the older Flash runtime/editor. The desktop app uses Electron.

New comment by inkmuffin in "The woes of sanitizing SVGs"

inkmuffin — Mon, 27 Apr 2026 23:45:56 +0000

That post mentions that I disclosed this to Scratch in February 2024. The POC in that post is functionally identical to a POC I provided them back then and in various subsequent communications.

New comment by inkmuffin in "The woes of sanitizing SVGs"

inkmuffin — Mon, 27 Apr 2026 23:34:06 +0000

They want to run getBBox [1] which requires the SVG to be in the DOM somewhere - otherwise it throws an error. They need to do this because SVGs tend to have very inaccurate viewboxes, especially when working with SVGs made in old versions of Scratch. getBBox is the easiest way to get a more accurate understanding of how big the stuff in the SVG is.

[1]: https://developer.mozilla.org/en-US/docs/Web/API/SVGGraphics...

New comment by inkmuffin in "The woes of sanitizing SVGs"

inkmuffin — Mon, 27 Apr 2026 23:32:18 +0000

This was the example from their test suite. I didn't want to clone and build a 2019 copy of Scratch to test it end-to-end since the specifics weren't super important anyway.