An Unwinnable Battle: Why SVG Sanitization Always Fails

Scratch's cascading SVG vulnerabilities reveal a fundamental principle in security: reactive patching of individual attack vectors cannot protect systems with inherently unsafe architectures. Each fix—from regex filtering to DOMPurify—fails because the root problem remains unchanged: parsing untrusted user SVG content itself. This case illustrates why some security challenges demand architectural redesign rather than incremental improvements.