enshrined/svg-sanitize

enshrined/svg-sanitize is a PHP library that parses untrusted SVG/XML input and strips it down to a safe, whitelisted set of tags and attributes, removing script execution vectors, event handlers, and other markup that could be abused for XSS when an SVG is rendered or embedded. Its sanitization approach is modeled on the widely-used JavaScript library DOMPurify, adapted for server-side PHP.

It exposes a single Sanitizer class with a sanitize() method, configurable tag/attribute whitelists, optional removal of remote references (to prevent HTTP leak/tracking pixels embedded in SVGs), and an issue-reporting API for surfacing why a given SVG was rejected or modified — making it a common building block for PHP applications and CMS plugins (notably WordPress) that accept user-uploaded SVG files.

What You Get

• A Sanitizer class exposing a single sanitize() method that returns cleaned SVG/XML or false on unparseable input
• Configurable tag and attribute whitelists via setAllowedTags/setAllowedAttrs and the TagInterface/AttributeInterface contracts
• Optional stripping of attributes that reference remote resources, preventing HTTP-leak/tracking-pixel style attacks embedded in SVGs
• An issue-reporting API (getXmlIssues()) for logging or surfacing why a given SVG was modified or rejected
• SVG minification support to strip unnecessary whitespace/metadata from sanitized output

Common Use Cases

• Sanitizing user-uploaded SVG files before storing or rendering them in a web application or CMS
• Hardening WordPress or other PHP CMS plugins that allow SVG uploads against stored XSS
• Stripping tracking pixels and remote references from SVGs sourced from third parties before display
• Pre-processing SVG assets in a build pipeline to guarantee only a known-safe tag/attribute set reaches production

Under The Hood

Architecture - The library’s entry point is Sanitizer.php, a ~750-line class that loads the input string into a PHP DOMDocument, walks the resulting node tree, and removes any element or attribute not present in the configured whitelist (defaulting to the tag/attribute lists defined in src/data/AllowedTags.php and src/data/AllowedAttributes.php). An XPath helper (src/data/XPath.php) is used to query and remove disallowed nodes, while ElementReference handles detection of href/xlink:href and similar reference attributes that can point at remote or script-executing content; Helper.php centralizes small utility functions (e.g. minification helpers) shared across the sanitizer. Tech Stack - Pure PHP with no third-party runtime dependencies beyond the built-in ext-dom and ext-libxml extensions, supporting PHP 7.1 through 8.x; PSR-4 autoloading exposes the enshrined\svgSanitize namespace. Code Quality - PHPUnit tests (supporting both PHPUnit 6.5 and 8.5, spanning the library’s long PHP-version support window) cover the sanitizer’s core behavior; the sanitization ruleset itself is explicitly derived from and kept aligned with DOMPurify’s battle-tested SVG allow-list, which anchors correctness in an externally audited security reference rather than a from-scratch list. API Design - The default path requires only new Sanitizer() and a sanitize($dirtySvg) call, with whitelist customization, remote-reference stripping, and issue reporting available as opt-in method calls (setAllowedTags, removeRemoteReferences, getXmlIssues) — a narrow, security-focused surface that keeps the safe default easy to reach for while still allowing stricter or looser policies when needed.