search

darylldoyle / svg-sanitizer

A PHP SVG/XML Sanitizer
GNU General Public License v2.0
454 stars 67 forks source link

Incorrect W3C namespace in XML is allowed #93

Open miicah opened 10 months ago

miicah commented 10 months ago 
<svg xmlns="https://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <path d="M30,1h40l29,29v40l-29,29h-40l-29-29v-40z" stroke="#000" fill="none"/> 
  <path d="M31,3h38l28,28v38l-28,28h-38l-28-28v-38z" fill="#a23"/> 
  <text x="50" y="68" font-size="48" fill="#FFF" text-anchor="middle"><![CDATA[410]]></text>
</svg>

Copy the above into the sanitiser and you will see the correct SVG. However when loading on an actual webpage, having the W3C XML namespace pointing to https will cause the SVG to fail to load.