search

darylldoyle / svg-sanitizer

A PHP SVG/XML Sanitizer
GNU General Public License v2.0
454 stars 67 forks source link

Why are HTML and MathML elements allowed? #74

Closed zcorpan closed 1 year ago

zcorpan commented 2 years ago

Since foreignObject is not allowed, the only places you can use HTML or MathML would be title or desc (at least in a text/html context). Since both of those are invisible, it doesn't seem compelling to allow usage of HTML or MathML elements at all?

Allowing HTML tag names makes it easier to find bypasses, especially when the output is used inline in text/html.

ohader commented 2 years ago

Sounds reasonable to me to drop all Other-ML elements due to foreignObject being not allowed. Besides that, there probably should be more unit test cases for exactly these kind of scenarios.