The woes of sanitizing SVGs

13 points by Teckla

olliej

Ugh it’s 2026 and sites are still trying to sanitize inputs. The only safe option is parsing and reserializing - filtering does not work for all the reasons in the article: weird encodings, new features, etc being the canonical source of this.

kornel

I wrote svg-hush that quite aggressively removes everything clever from SVGs.

Instead of trying to parse full CSS syntax, I look for the "url(" token and filter that. Any non-trivial syntax (nested parens, unterminated strings) gets deleted. The grammar is complex, but you can't have a URL without "url(". Fortunately CSS doesn't allow comments or weird escaping there.

fanf

but you can't have a URL without "url("

This article says image-set() can take a URL without url().