[Security] Image in GUI can cause SVG XSS

[hanmyeonglee]

Description

SVG XSS is possible if a server that does not set up CSP properly provides a page that uses Babylonjs GUI.Image.

Environment

1. Server doesn't set proper CSP
2. javascript in SVG

Example

SVG XSS example

localhost Server Code

from flask import Flask
from flask_cors import CORS
import time

app = Flask(__name__)
CORS(app)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=54321)

Improvement

When Babylonjs' image loader parses svg, tags other than those related to svg should not be executed after parsing such as <link> or <img> tag

[deltakosh]

Hey and thanks for the report! Do you want to do a PR for it?
cc @docEdub as this is security related

[sebavan]

@hanmyeonglee do you happen to have such a svg available to repro ?

[docEdub]

I've got this reproducing locally. Investigating fixes now.