Is it \'legal\' to have an SVG with a data in a foreign domain i.e. (data="//da86ge957603k.cloudfront.net/rails/grafitti_logo-f4e8238a87c979c0cf5b41481c982b71.svg"), a
It's documented here by w3c. In detail here for the object tag that you can't do cross domain access to the data of a tag except via CORS.
There's a more readable distillation on MDN and to get round it you need to enable CORS on the remote site (if you can).