Question 1

Why is a <script> tag inside an SVG file dangerous?

Accepted Answer

SVG is an XML format that can embed executable JavaScript. A <script> tag inside an SVG can run arbitrary code in the context of the page displaying it -- a real risk if the SVG comes from an untrusted source, like a user upload, rather than your own trusted assets.

Question 2

What does removing the onclick attribute accomplish?

Accepted Answer

Event handler attributes (onclick, onload, onmouseover, and similar) can also execute JavaScript when triggered, independent of a dedicated <script> tag -- removing them closes that same class of code-execution risk on individual elements.

Question 3

Is this sanitizer a complete, production-grade security solution?

Accepted Answer

Not on its own. Regex sanitizer, not a full SVG allow-list. External hrefs are not stripped. It's a pattern-matching filter for known dangerous constructs. A fully robust sanitizer typically uses an allow-list approach (explicitly permitting only known-safe tags and attributes) and should generally run server-side for content from genuinely untrusted sources.

Question 4

Does this remove external references, like a link to an outside resource?

Accepted Answer

No. Regex sanitizer, not a full SVG allow-list. External hrefs are not stripped. References via href or xlink:href that point to external content aren't stripped by this tool -- a more complete sanitization process would need to address those separately.

Question 5

Should I trust this for SVGs uploaded by the public on a production site?

Accepted Answer

Use it as a quick client-side check, but for genuinely untrusted, public-facing uploads, a well-maintained, allow-list-based sanitization library running server-side is the more defensible, production-appropriate approach.

SVG Icon Code Sanitizer & Inline Converter

Stripping active content, keeping the visible shape

SVG Icon Code Sanitizer & Inline Converter

Calculator

Stripping active content, keeping the visible shape