X XFediYour place in the Fediverse
XFEDI

Conversation

ActivityPub

svg-sanitize rebuilds untrusted SVG as static vector graphics only. It does not simply search and replace script tags. It parses XML with defusedxml, checks resource limits, and constructs an entirely new XML tree from a small, explicit allowlist of elements, attributes, and valid values.

Thanks to @wachizungu for the initial idea at the @hack_lu hackathon and also @therealsaumil to trigger me again about SVG at the 20th edition hack.lu ;-)

It's a prototype and maybe utterly broken.

🔗 https://github.com/adulau/svg-sanitize

#svg #cybersecurity #hacklu #opensource

GitHubGitHub - adulau/svg-sanitize: svg-sanitize - restrictive, visual-only SVG sanitizersvg-sanitize - restrictive, visual-only SVG sanitizer - adulau/svg-sanitize
↩ Reply ♡ 0 · ↻ 0 ↗ Original

Oct 23, 2026 · 20:18 UTC

Replies