GUIDE深度 · Deep dive
SVG Safety: Scripts, Links and Sanitizing
SVG is XML and can contain scripts, event attributes and external references. Opening unknown SVGs is risky; this tool strips scripts/events/external hrefs before rendering, but that does not replace antivirus or trusted sourcing.
script/on* may execute.
External images/fonts can leak IP/requests.
foreignObject can embed HTML.
Removes script/foreignObject/on*.
Removes hrefs that are not #/data:.
Still only process trusted files.
FAQ
Is sanitized SVG absolutely safe?
Not absolute; parsers/browsers still have edge cases.
Why remove external images?
To avoid third-party requests/leaks during conversion.