When dvisvgm emits a warning, it does it to stdout. We effectively pipe dvisvgm to convert, which tries to parse the warnings and fail:
quantum@REDACTED:~$ dvisvgm --no-fonts --stdout --verbosity=0 shit.dvi
*** WARNING - you have selected SAFER, indicating you want Ghostscript
to execute in a safer environment, but at the same time
have selected WRITESYSTEMDICT. Unless you use this option with
care and specifically, remember to execute code like:
"systemdict readonly pop"
it is possible that malicious <?xml version='1.0' encoding='UTF-8'?>
<!-- This file was generated by dvisvgm 1.15.1 -->
<svg height='114.987pt' version='1.1' viewBox='-72.0031 -72.0032 171.682 114.987' width='171.682pt' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink'>
*snip*
quantum@REDACTED:~$ dvisvgm --no-fonts --stdout --verbosity=0 shit.dvi | rsvg-convert -o shit.png /dev/stdin
Error reading SVG:Error domain 1 code 4 on line 1 column 1 of file:///dev/stdin: Start tag expected, '<' not found
When
dvisvgmemits a warning, it does it tostdout. We effectively pipedvisvgmtoconvert, which tries to parse the warnings and fail: