{"id":13704430,"url":"https://github.com/darylldoyle/svg-sanitizer","last_synced_at":"2025-04-29T18:46:10.485Z","repository":{"id":37545983,"uuid":"37688378","full_name":"darylldoyle/svg-sanitizer","owner":"darylldoyle","description":"A PHP SVG/XML Sanitizer","archived":false,"fork":false,"pushed_at":"2025-01-13T09:34:53.000Z","size":362,"stargazers_count":498,"open_issues_count":19,"forks_count":66,"subscribers_count":24,"default_branch":"master","last_synced_at":"2025-04-10T23:57:24.243Z","etag":null,"topics":["php-library","security","svg","svg-sanitizer","xml"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/darylldoyle.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-06-18T22:17:33.000Z","updated_at":"2025-04-09T08:18:34.000Z","dependencies_parsed_at":"2024-01-12T10:25:57.130Z","dependency_job_id":"b583dea2-4598-4b65-b3fe-777547d3eee0","html_url":"https://github.com/darylldoyle/svg-sanitizer","commit_stats":{"total_commits":144,"total_committers":18,"mean_commits":8.0,"dds":0.7152777777777778,"last_synced_commit":"239e257605e2141265b429e40987b2ee51bba4b4"},"previous_names":[],"tags_count":47,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/darylldoyle%2Fsvg-sanitizer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/darylldoyle%2Fsvg-sanitizer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/darylldoyle%2Fsvg-sanitizer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/darylldoyle%2Fsvg-sanitizer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/darylldoyle","download_url":"https://codeload.github.com/darylldoyle/svg-sanitizer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251562804,"owners_count":21609620,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["php-library","security","svg","svg-sanitizer","xml"],"created_at":"2024-08-02T21:01:09.509Z","updated_at":"2025-04-29T18:46:10.468Z","avatar_url":"https://github.com/darylldoyle.png","language":"PHP","funding_links":[],"categories":["目录","图像( Imagery )","PHP"],"sub_categories":["图像 Imagery"],"readme":"# svg-sanitizer\n\n[![Build Status](https://github.com/darylldoyle/svg-sanitizer/actions/workflows/tests.yml/badge.svg?branch=master)](https://travis-ci.org/darylldoyle/svg-sanitizer) [![Test Coverage](https://codeclimate.com/github/darylldoyle/svg-sanitizer/badges/coverage.svg)](https://codeclimate.com/github/darylldoyle/svg-sanitizer/coverage)\n\nThis is my attempt at building a decent SVG sanitizer in PHP. The work is largely borrowed from [DOMPurify](https://github.com/cure53/DOMPurify).\n\n## Installation\n\nEither require `enshrined/svg-sanitize` through composer or download the repo and include the old way!\n\n## Usage\n\nUsing this is fairly easy. Create a new instance of `enshrined\\svgSanitize\\Sanitizer` and then call the `sanitize` whilst passing in your dirty SVG/XML\n\n**Basic Example**\n\n```php\nuse enshrined\\svgSanitize\\Sanitizer;\n\n// Create a new sanitizer instance\n$sanitizer = new Sanitizer();\n\n// Load the dirty svg\n$dirtySVG = file_get_contents('filthy.svg');\n\n// Pass it to the sanitizer and get it back clean\n$cleanSVG = $sanitizer-\u003esanitize($dirtySVG);\n\n// Now do what you want with your clean SVG/XML data\n\n```\n\n## Output\n\nThis will either return a sanitized SVG/XML string or boolean `false` if XML parsing failed (usually due to a badly formatted file).\n\n## Options\n\nYou may pass your own whitelist of tags and attributes by using the `Sanitizer::setAllowedTags` and `Sanitizer::setAllowedAttrs` methods respectively.\n\nThese methods require that you implement the `enshrined\\svgSanitize\\data\\TagInterface` or `enshrined\\svgSanitize\\data\\AttributeInterface`.\n\n## Remove remote references\n\nYou have the option to remove attributes that reference remote files, this will stop HTTP leaks but will add an overhead to the sanitizer.\n\nThis defaults to false, set to true to remove references.\n\n`$sanitizer-\u003eremoveRemoteReferences(true);`\n\n## Viewing Sanitization Issues\n\nYou may use the `getXmlIssues()` method to return an array of issues that occurred during sanitization.\n\nThis may be useful for logging or providing feedback to the user on why an SVG was refused.\n\n`$issues = $sanitizer-\u003egetXmlIssues();`\n\n## Minification\n\nYou can minify the XML output by calling `$sanitizer-\u003eminify(true);`.\n\n## Demo\nThere is a demo available at: [http://svg.enshrined.co.uk/](http://svg.enshrined.co.uk/)\n\n## WordPress\n\nI've just released a WordPress plugin containing this code so you can sanitize your WordPress uploads. It's available from the WordPress plugin directory: [https://wordpress.org/plugins/safe-svg/](https://wordpress.org/plugins/safe-svg/)\n\n## Drupal\n\n[Michael Potter](https://github.com/heyMP) has kindly created a Drupal module for this library which is available at: [https://www.drupal.org/project/svg_sanitizer](https://www.drupal.org/project/svg_sanitizer)\n\n## TYPO3\n\nThis SVG sanitizer library is used per default in the core of TYPO3 v9 and later versions.\nSee [corresponding changelog entry](https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/9.5.x/Important-94492-IntroduceSVGSanitizer.html) for more details.\n\n## Tests\n\nYou can run these by running `vendor/bin/phpunit` from the base directory of this package.\n\n## Standalone scanning of files via CLI\n\nThanks to the work by [gudmdharalds](https://github.com/gudmdharalds) there's now a standalone scanner that can be used via the CLI.\n\nAny errors will be output in JSON format. See [the PR](https://github.com/darylldoyle/svg-sanitizer/pull/25) for an example.\n\nUse it as follows: `php svg-scanner.php ~/svgs/myfile.svg`\n\n## To-Do\n\nMore extensive testing for the SVGs/XML would be lovely, I'll try and add these soon. If you feel like doing it for me, please do and make a PR!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdarylldoyle%2Fsvg-sanitizer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdarylldoyle%2Fsvg-sanitizer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdarylldoyle%2Fsvg-sanitizer/lists"}