Required help for sanitizing SVG image

[nramc]

Hello!
Hope you are doing well.
I saw few recent changes about parsing xml content.
I have a use case where i want to validate and sanitize svg xml image content.

i tried all my ways to make it work, but no luck. after using cleaner the cleaned document body always empty.
i have a doubt not that is it possible to use jsoup for sanitizing svg content ?
or is there any other better ways or alternative to sanitize svg content ?

below is my sample code snippet shows my use case.
I really appreciate any help on this please.!

class SvgImageSanitizationResponseTest {

    @Test
    void sanitize() {
        String svgContent = """
                <svg xmlns="http://www.w3.org/2000/svg">
                 <rect width="100" height="50" fill="blue"/>
                  <script>alert('XSS');</script>
                </svg>""";
        Cleaner cleaner = new Cleaner(Safelist.relaxed());

        Document parsed = Jsoup.parse(svgContent, Parser.xmlParser());

        Document cleaned = cleaner.clean(parsed);

        assertThat(cleaned.body().html()).isNotBlank().doesNotContain("<script>");
        assertThat(cleaner.isValid(parsed)).isFalse();
    }

}

Kindly let me know if you need any more details.
Thank in advance!
Ram

[jhy]

Hi there,

It's definitely possible to use jsoup to do this. But there is not a canned Safelist for SVGs; you will need to configure that directly.

See docs:

Cookbook - Safelist Sanitizer as introduction
Safelist API for the configuration API
SVG example configuration (from this bug report)

Note that I'm not vouching for the "safety" of all those elements and attributes; just that jsoup will sanitize SVG elements according to the rules defined in what you're defining as safe in the safelist (aka allow-list).

Cheers,
Jonathan

[nramc]

Thank you, @jhy !
I will have a look into the resources and will try again.