Does this not run into the same security issue as described in T5593: [Epic] SVG client side rendering regarding scripts potentially uploaded before the dawn of sanitization?

In T407710#11288105, @Izno wrote:

Does this not run into the same security issue as described in T5593: [Epic] SVG client side rendering regarding scripts potentially uploaded before the dawn of sanitization?

Not really. The security of this is based on the idea that SVGs are being run in "secure animated mode" https://svgwg.org/specs/integration/#secure-animated-mode so sanitization is not really relavent.

Quite frankly it doesn't matter on the other ticket either. The risky part of SVGs is them being on upload.wikimedia.org. Using them on site in an <img> tag is not risky.

If there were malicious svgs from before the dawn of sanitization, it would be a problem *right now* because they are on upload.wikimedia.org which is where the risk is. Contrary to popular opinion, upload.wikimedia.org is not properly isolated from the main site so having malicious svgs there would be bad (And nobody seems particularly interested in fixing that, sadly).

The only thing that would increase risk here is if you could use the <svg> tags directly on a page instead of in an <img> tag. However i don't think anyone is proposing that in any of these tickets.

Edit: There is a minor risk in this scheme, where the user could right-click the image, and select download file, and then view the file locally, which if malicious might reveal their IP address.