render SVG logo

[koalatux]

The app currently does not render SVG files as logo.

[rorist]

hi,

it may be possible to execute some java using svg or some other stuff. It's quite a difficult task to secure svg. Should be make a class that converts svg to png instead or use a 3rd party that make it right ?

We have to remeber that the spaceapi is user input and even though it's json we're parsing it at some point.

[dbrgn]

This is definitely non-trivial and would require to add quite a big SVG parsing and rendering library to the app. SVG is a huge standard. Most SVG libraries also require native code, which increases attack surface complicates distribution because you now need to distribute per-architecture APKs, compiled for the different target platforms.

I would personally prefer if the spaces would simply provide pixel formats for the logos. We could expand the spec to allow multiple logo formats, where I'd require a PNG logo and allow an additional SVG logo.

[koalatux]

What about using WebView to render the SVG? Since Android 3.0 WebView supports SVG. Javascript is turned off by default and you may also want to block loading of external resources with the setBlockNetworkLoads (I don't know if this is enough to prevent all malicious stuff, I am not an Android developer).

[dbrgn]

Hmm, that could work...