The goal of this tool is to make arbitrary SVG files as benign and safe to serve as images in other common Web file formats. SVG files aren't just images, they're documents with full access to all HTML and JavaScript features. This tool filters SVG files to remove use of any potentially risky features.
Removes scripting. Prevents SVG files from being used for cross-site scripting attacks. Although browsers don't allow scripts in , they do allow scripting when SVG files are opened directly as a top-level document.
Removes hyperlinks to other documents. Makes SVG files less attractive for SEO spam and phishing.
Removes references to cross-origin resources. Stops 3rd parties from tracking who is viewing the image.
trungdq88
commented
2 years ago
It’s early days yet, but might SVG Hush be a good match for DevUtils?
https://github.com/cloudflare/svg-hush