Method sanitizeElement

processing/svg/svg.go:92–127

sanitizeElement sanitizes a single SVG element. It returns true if the element should be kept, false if it should be removed.

(el *xmlparser.Node)

// sanitizeElement sanitizes a single SVG element.
// It returns true if the element should be kept, false if it should be removed.
func (p *Processor) sanitizeElement(el *xmlparser.Node) bool {
	if el == nil {
		return false
	}

	tagName := el.Name.Local()

	// Strip <script>, <iframe>, and <form> tags
	if tagName == "script" || tagName == "iframe" || tagName == "form" {
		return false
	}

	// Filter out unsafe attributes (such as on* events)
	el.Attrs.Filter(func(attr *xmlparser.Attribute) bool {
		_, unsafe := unsafeAttrs[attr.Name.Local()]
		return !unsafe
	})

	// Special handling for <use> tags.
	if tagName == "use" {
		el.Attrs.Filter(func(attr *xmlparser.Attribute) bool {
			// Keep non-href attributes
			if attr.Name.Local() != "href" {
				return true
			}
			// Strip hrefs that are not internal references
			return len(attr.Value) == 0 || attr.Value[0] == '#'
		})
	}

	// Recurse into children
	el.FilterChildNodes(p.sanitizeElement)

	// Keep this element
	return true
}