Oops, sent too early. We could add a new image-loading mechanism that lets authors opt into allowing SVG images to load external resources. However, that may make it too easy for authors to accidentally enable the above scenarios.
A better idea might be to provide a way to pass in resources as parameters, including from a CSS style sheet. This might even perform better if you have a lot of SVG images using the same resources. Sketch: background-image: url-with-params("image.svg", "shared-resources.svg"); In the SVG: <rect fill="param(1#pattern)"> You'd require everything in url-with-params to be same-origin. Rob -- lbir ye,ea yer.tnietoehr rdn rdsme,anea lurpr edna e hnysnenh hhe uresyf toD selthor stor edna siewaoeodm or v sstvr esBa kbvted,t rdsme,aoreseoouoto o l euetiuruewFa kbn e hnystoivateweh uresyf tulsa rehr rdm or rnea lurpr .a war hsrer holsa rodvted,t nenh hneireseoouot.tniesiewaoeivatewt sstvr esn