svg-sanitize 0.1.0__tar.gz

svg_sanitize-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alexandre Dulaunoy 
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

svg_sanitize-0.1.0/PKG-INFO

@@ -0,0 +1,160 @@
+Metadata-Version: 2.4
+Name: svg-sanitize
+Version: 0.1.0
+Summary: Strict, passive-only SVG reconstruction/sanitization prototype
+Author-email: Alexandre Dulaunoy <a@foo.be>
+License: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: defusedxml<1,>=0.7.1
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+# svg-sanitize — restrictive, visual-only SVG sanitizer (prototype)
+
+`svg-sanitize` rebuilds untrusted SVG as **static vector graphics only**. It does
+not simply search and replace `script` tags. It parses XML with `defusedxml`,
+checks resource limits, and constructs an entirely new XML tree from a small,
+explicit allowlist of elements, attributes, and valid values.
+
+**Prototype, not a formally verified security boundary.** Review, fuzz and test
+against your target SVG renderers before using this in a security-sensitive
+production system.
+
+## Why svg-sanitize?
+
+The **svg-sanitize** project started following security reviews conducted by **Jeroen Pinoy**, which highlighted the potential security risks associated with handling untrusted SVG files. This initial prototype was done during the hack.lu 2026 hackathon after the hot ones interview ;-)
+
+Although SVG is primarily an image format, it can contain active content, including JavaScript, event handlers, external resource references, and other potentially malicious elements. This makes SVG a potential attack vector, particularly when displaying user-supplied images in web applications.
+
+**svg-sanitize** is a lightweight Python library designed to transform untrusted SVG files into passive, visual-only SVG documents. Instead of attempting to identify every possible malicious payload, the library follows a strict allowlist approach, preserving only elements and attributes required for static vector graphics.
+
+The objective is to provide a simple, reusable, and open-source security component that reduces the attack surface when processing SVG files, without requiring applications to implement their own SVG sanitization logic.
+
+## Installation
+
+```bash
+python -m pip install -e './svg-sanitize[test]'
+# or, when inside the extracted directory:
+python -m pip install -e '.[test]'
+```
+
+Python 3.10+; the only runtime dependency is `defusedxml`.
+
+## Python usage
+
+```python
+from svg_sanitize import sanitize_svg, SVGValidationError
+
+untrusted_svg = b'''<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">
+  <script>alert(1)</script>
+  <rect width="80" height="40" fill="red"/>
+</svg>'''
+
+try:
+    passive_svg = sanitize_svg(untrusted_svg)
+except SVGValidationError as exc:
+    print(f"SVG rejected: {exc}")
+else:
+    print(passive_svg)
+    # <svg xmlns="http://www.w3.org/2000/svg"><rect width="80" height="40" fill="red" /></svg>
+```
+
+For custom input and rendering limits:
+
+```python
+from svg_sanitize import Limits, sanitize_svg
+
+output = sanitize_svg(untrusted_svg, limits=Limits(max_input_bytes=100_000, max_nodes=1_000))
+```
+
+## CLI
+
+```bash
+svg-sanitize examples/malicious.svg -o clean.svg
+# alternatively:
+python -m svg_sanitize examples/malicious.svg -o clean.svg
+```
+
+Run tests:
+
+```bash
+python -m pytest -q
+```
+
+## CI and PyPI releases
+
+The [GitHub Actions workflow](.github/workflows/ci.yml) runs the tests on Python
+3.10–3.14 for pull requests, pushes to `main`, and published GitHub releases.
+After the tests pass, it builds and checks both the source distribution and wheel.
+Only a published release triggers an upload to PyPI, using those checked artifacts.
+
+Before the first release:
+
+1. Create a GitHub Actions environment named `pypi` in this repository. Add any
+   desired deployment protection rules there.
+2. Configure a [PyPI trusted publisher](https://docs.pypi.org/trusted-publishers/)
+   for the `svg-sanitize` project with owner `adulau`, repository `svg-sanitize`,
+   workflow filename `ci.yml`, and environment name `pypi`. If the project does not
+   exist yet, configure a pending publisher in your PyPI account instead.
+
+No PyPI API token or GitHub repository secret is required. For each release,
+update `project.version` in `pyproject.toml`, merge the change, then create and
+publish a GitHub release from that commit with a matching tag, such as `v0.1.0`
+or `0.1.0`. A mismatched tag fails before publishing. Each upload must use a new
+version because PyPI does not allow replacing previously uploaded files.
+Published prereleases also run this workflow; drafts do not.
+
+## What is allowed
+
+Only `svg`, `g`, `rect`, `circle`, `ellipse`, `line`, `polyline`, `polygon`,
+`path`, `text`, and `tspan`. Numeric dimensions and coordinates, path data,
+point lists, limited transforms, limited named/hex/rgb colors, static stroke/
+fill and selected text formatting properties are validated individually.
+
+SVGs using gradients, filters, clipping paths, `<use>`, images, embedded fonts,
+CSS, masks, symbols, hyperlinks, animation or scripting **will lose those
+features**. In particular, gradient fills `fill="url(#id)"` are discarded,
+including local URLs. This is an explicit security/functionality tradeoff.
+
+## What is forbidden
+
+- JavaScript and scriptable elements; `onload`, `onclick`, and all event handlers.
+- CSS (`<style>`, `style=`), including `@import`, `url(...)`, and expressions.
+- All links and resources, including `href`, `xlink:href`, external and internal
+  references, `data:` URLs, `<image>`, `<use>`, fonts, filters and gradients.
+- `<foreignObject>` and arbitrary/HTML/XML namespace elements.
+- SVG animation and SMIL (`animate`, `set`, `animateTransform`, etc.).
+- DTDs, XML entity declarations, external entity references, malformed XML.
+- Unknown attributes (including `id`, `class`, `xml:base`, and `xmlns:xlink`).
+
+Unknown elements are removed **with their complete subtrees**; the input is
+never copied wholesale to output. The implementation also enforces limits on
+input bytes, output bytes, node count, depth, attribute sizes and text sizes.
+
+## Deployment advice
+
+For untrusted-user uploads, make the sanitized document only one defense layer:
+
+1. Keep the original SVG out of any publicly served directory.
+2. Serve the sanitized output with `Content-Type: image/svg+xml`, ideally from
+   a separate cookieless domain with `Content-Disposition: attachment` for
+   downloads. For display, prefer `<img src="...">` rather than inline SVG.
+3. Use CSP restricting `script-src 'none'; object-src 'none'; base-uri 'none';
+   default-src 'none'; img-src 'self' data:` on the serving endpoint where
+   appropriate, and ensure application CSP is also restrictive.
+4. Treat the output as untrusted in any subsequent XML/SVG manipulation pipeline;
+   downstream software might add back risky features. If preserving more complex
+   SVG features is necessary, consider rasterizing with a hardened, resource-
+   isolated renderer instead of broadening the allowlist.
+5. Use browser-based regression tests, fuzz tests, and multiple-engine testing
+   before relying on the package for production security.
+
+**No SVG sanitizer can promise protection against all future rendering-engine
+vulnerabilities.** This prototype targets active-content injection and external
+resource-loading pathways, not malicious graphical impersonation or renderer
+memory-corruption bugs.
+
+MIT licensed (see `LICENSE`).

svg_sanitize-0.1.0/README.md

@@ -0,0 +1,146 @@
+# svg-sanitize — restrictive, visual-only SVG sanitizer (prototype)
+
+`svg-sanitize` rebuilds untrusted SVG as **static vector graphics only**. It does
+not simply search and replace `script` tags. It parses XML with `defusedxml`,
+checks resource limits, and constructs an entirely new XML tree from a small,
+explicit allowlist of elements, attributes, and valid values.
+
+**Prototype, not a formally verified security boundary.** Review, fuzz and test
+against your target SVG renderers before using this in a security-sensitive
+production system.
+
+## Why svg-sanitize?
+
+The **svg-sanitize** project started following security reviews conducted by **Jeroen Pinoy**, which highlighted the potential security risks associated with handling untrusted SVG files. This initial prototype was done during the hack.lu 2026 hackathon after the hot ones interview ;-)
+
+Although SVG is primarily an image format, it can contain active content, including JavaScript, event handlers, external resource references, and other potentially malicious elements. This makes SVG a potential attack vector, particularly when displaying user-supplied images in web applications.
+
+**svg-sanitize** is a lightweight Python library designed to transform untrusted SVG files into passive, visual-only SVG documents. Instead of attempting to identify every possible malicious payload, the library follows a strict allowlist approach, preserving only elements and attributes required for static vector graphics.
+
+The objective is to provide a simple, reusable, and open-source security component that reduces the attack surface when processing SVG files, without requiring applications to implement their own SVG sanitization logic.
+
+## Installation
+
+```bash
+python -m pip install -e './svg-sanitize[test]'
+# or, when inside the extracted directory:
+python -m pip install -e '.[test]'
+```
+
+Python 3.10+; the only runtime dependency is `defusedxml`.
+
+## Python usage
+
+```python
+from svg_sanitize import sanitize_svg, SVGValidationError
+
+untrusted_svg = b'''<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">
+  <script>alert(1)</script>
+  <rect width="80" height="40" fill="red"/>
+</svg>'''
+
+try:
+    passive_svg = sanitize_svg(untrusted_svg)
+except SVGValidationError as exc:
+    print(f"SVG rejected: {exc}")
+else:
+    print(passive_svg)
+    # <svg xmlns="http://www.w3.org/2000/svg"><rect width="80" height="40" fill="red" /></svg>
+```
+
+For custom input and rendering limits:
+
+```python
+from svg_sanitize import Limits, sanitize_svg
+
+output = sanitize_svg(untrusted_svg, limits=Limits(max_input_bytes=100_000, max_nodes=1_000))
+```
+
+## CLI
+
+```bash
+svg-sanitize examples/malicious.svg -o clean.svg
+# alternatively:
+python -m svg_sanitize examples/malicious.svg -o clean.svg
+```
+
+Run tests:
+
+```bash
+python -m pytest -q
+```
+
+## CI and PyPI releases
+
+The [GitHub Actions workflow](.github/workflows/ci.yml) runs the tests on Python
+3.10–3.14 for pull requests, pushes to `main`, and published GitHub releases.
+After the tests pass, it builds and checks both the source distribution and wheel.
+Only a published release triggers an upload to PyPI, using those checked artifacts.
+
+Before the first release:
+
+1. Create a GitHub Actions environment named `pypi` in this repository. Add any
+   desired deployment protection rules there.
+2. Configure a [PyPI trusted publisher](https://docs.pypi.org/trusted-publishers/)
+   for the `svg-sanitize` project with owner `adulau`, repository `svg-sanitize`,
+   workflow filename `ci.yml`, and environment name `pypi`. If the project does not
+   exist yet, configure a pending publisher in your PyPI account instead.
+
+No PyPI API token or GitHub repository secret is required. For each release,
+update `project.version` in `pyproject.toml`, merge the change, then create and
+publish a GitHub release from that commit with a matching tag, such as `v0.1.0`
+or `0.1.0`. A mismatched tag fails before publishing. Each upload must use a new
+version because PyPI does not allow replacing previously uploaded files.
+Published prereleases also run this workflow; drafts do not.
+
+## What is allowed
+
+Only `svg`, `g`, `rect`, `circle`, `ellipse`, `line`, `polyline`, `polygon`,
+`path`, `text`, and `tspan`. Numeric dimensions and coordinates, path data,
+point lists, limited transforms, limited named/hex/rgb colors, static stroke/
+fill and selected text formatting properties are validated individually.
+
+SVGs using gradients, filters, clipping paths, `<use>`, images, embedded fonts,
+CSS, masks, symbols, hyperlinks, animation or scripting **will lose those
+features**. In particular, gradient fills `fill="url(#id)"` are discarded,
+including local URLs. This is an explicit security/functionality tradeoff.
+
+## What is forbidden
+
+- JavaScript and scriptable elements; `onload`, `onclick`, and all event handlers.
+- CSS (`<style>`, `style=`), including `@import`, `url(...)`, and expressions.
+- All links and resources, including `href`, `xlink:href`, external and internal
+  references, `data:` URLs, `<image>`, `<use>`, fonts, filters and gradients.
+- `<foreignObject>` and arbitrary/HTML/XML namespace elements.
+- SVG animation and SMIL (`animate`, `set`, `animateTransform`, etc.).
+- DTDs, XML entity declarations, external entity references, malformed XML.
+- Unknown attributes (including `id`, `class`, `xml:base`, and `xmlns:xlink`).
+
+Unknown elements are removed **with their complete subtrees**; the input is
+never copied wholesale to output. The implementation also enforces limits on
+input bytes, output bytes, node count, depth, attribute sizes and text sizes.
+
+## Deployment advice
+
+For untrusted-user uploads, make the sanitized document only one defense layer:
+
+1. Keep the original SVG out of any publicly served directory.
+2. Serve the sanitized output with `Content-Type: image/svg+xml`, ideally from
+   a separate cookieless domain with `Content-Disposition: attachment` for
+   downloads. For display, prefer `<img src="...">` rather than inline SVG.
+3. Use CSP restricting `script-src 'none'; object-src 'none'; base-uri 'none';
+   default-src 'none'; img-src 'self' data:` on the serving endpoint where
+   appropriate, and ensure application CSP is also restrictive.
+4. Treat the output as untrusted in any subsequent XML/SVG manipulation pipeline;
+   downstream software might add back risky features. If preserving more complex
+   SVG features is necessary, consider rasterizing with a hardened, resource-
+   isolated renderer instead of broadening the allowlist.
+5. Use browser-based regression tests, fuzz tests, and multiple-engine testing
+   before relying on the package for production security.
+
+**No SVG sanitizer can promise protection against all future rendering-engine
+vulnerabilities.** This prototype targets active-content injection and external
+resource-loading pathways, not malicious graphical impersonation or renderer
+memory-corruption bugs.
+
+MIT licensed (see `LICENSE`).

svg_sanitize-0.1.0/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "svg-sanitize"
+authors = [{name = "Alexandre Dulaunoy", email = "a@foo.be"}]
+version = "0.1.0"
+description = "Strict, passive-only SVG reconstruction/sanitization prototype"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+dependencies = ["defusedxml>=0.7.1,<1"]
+
+[project.optional-dependencies]
+test = ["pytest>=7"]
+
+[project.scripts]
+svg-sanitize = "svg_sanitize.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

svg_sanitize-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

svg_sanitize-0.1.0/src/svg_sanitize/__init__.py

@@ -0,0 +1,5 @@
+"""Build purely visual SVG output from untrusted SVG/XML."""
+
+from .sanitizer import Limits, SVGValidationError, sanitize_svg
+
+__all__ = ["Limits", "SVGValidationError", "sanitize_svg"]

svg_sanitize-0.1.0/src/svg_sanitize/__main__.py

@@ -0,0 +1,31 @@
+"""CLI: python -m svg_sanitize untrusted.svg -o clean.svg"""
+
+import argparse
+import sys
+from pathlib import Path
+
+from . import Limits, SVGValidationError, sanitize_svg
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Strip SVG down to static visual primitives")
+    parser.add_argument("input", type=Path, help="SVG input file")
+    parser.add_argument("-o", "--output", type=Path, help="SVG output file (default stdout)")
+    args = parser.parse_args()
+    limits = Limits()
+    try:
+        with args.input.open("rb") as f:
+            content = f.read(limits.max_input_bytes + 1)
+        cleaned = sanitize_svg(content, limits=limits)
+        if args.output:
+            args.output.write_text(cleaned + "\n", encoding="utf-8")
+        else:
+            sys.stdout.write(cleaned + "\n")
+    except (SVGValidationError, OSError) as exc:
+        print(f"svg-sanitize: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

svg_sanitize-0.1.0/src/svg_sanitize/sanitizer.py

@@ -0,0 +1,392 @@
+"""Strict, visual-only SVG sanitizer.
+
+This is intentionally not a general-purpose SVG optimizer. It constructs a
+new XML tree from a small whitelist. Unsupported elements, attributes, and
+attribute values do not reach the result.
+"""
+
+from __future__ import annotations
+
+import math
+import re
+import xml.etree.ElementTree as ET
+from dataclasses import dataclass
+
+from defusedxml import ElementTree as SafeET
+from defusedxml.common import DefusedXmlException
+
+SVG_NS = "http://www.w3.org/2000/svg"
+ET.register_namespace("", SVG_NS)
+
+
+class SVGValidationError(ValueError):
+    """The input SVG is invalid, prohibited XML, or exceeds resource limits."""
+
+
+@dataclass(frozen=True)
+class Limits:
+    max_input_bytes: int = 1_048_576
+    max_output_bytes: int = 1_048_576
+    max_nodes: int = 10_000
+    max_depth: int = 64
+    max_attributes_per_node: int = 64
+    max_attribute_chars: int = 65_536
+    max_text_chars: int = 100_000
+    max_path_chars: int = 65_536
+
+
+DEFAULT_LIMITS = Limits()
+
+# Deliberately exclude: script, style, a, use, image, foreignObject, animate,
+# set, filter, mask, clipPath, pattern, gradients, defs, metadata, etc.
+CONTAINERS = frozenset({"svg", "g"})
+SHAPES = frozenset({"rect", "circle", "ellipse", "line", "polyline", "polygon", "path"})
+TEXT_TAGS = frozenset({"text", "tspan"})
+ALLOWED_TAGS = CONTAINERS | SHAPES | TEXT_TAGS
+
+PRESENTATION = frozenset({
+    "fill", "fill-opacity", "fill-rule", "stroke", "stroke-width",
+    "stroke-opacity", "stroke-linecap", "stroke-linejoin",
+    "stroke-miterlimit", "stroke-dasharray", "stroke-dashoffset",
+    "opacity", "display", "visibility", "vector-effect",
+    "font-family", "font-size", "font-style", "font-weight",
+    "text-anchor", "dominant-baseline", "letter-spacing", "word-spacing",
+    "shape-rendering", "text-rendering",
+})
+
+GEOMETRY = {
+    "svg": frozenset({"x", "y", "width", "height", "viewBox", "preserveAspectRatio", "transform"}),
+    "g": frozenset({"transform"}),
+    "rect": frozenset({"x", "y", "width", "height", "rx", "ry", "transform"}),
+    "circle": frozenset({"cx", "cy", "r", "transform"}),
+    "ellipse": frozenset({"cx", "cy", "rx", "ry", "transform"}),
+    "line": frozenset({"x1", "x2", "y1", "y2", "transform"}),
+    "polyline": frozenset({"points", "transform"}),
+    "polygon": frozenset({"points", "transform"}),
+    "path": frozenset({"d", "transform"}),
+    "text": frozenset({"x", "y", "dx", "dy", "transform"}),
+    "tspan": frozenset({"x", "y", "dx", "dy", "rotate"}),
+}
+
+NUMBER = r"[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?"
+NUMBER_RE = re.compile(NUMBER)
+LENGTH_RE = re.compile(rf"({NUMBER})(px|%)?\Z", re.ASCII)
+COLOR_HEX_RE = re.compile(r"#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{1})?(?:[0-9a-fA-F]{2})?(?:[0-9a-fA-F]{2})?\Z")
+COLOR_FUNC_RE = re.compile(r"(rgb|rgba)\(\s*([^()]*)\s*\)\Z", re.IGNORECASE)
+PATH_TOKEN_RE = re.compile(rf"{NUMBER}|[MmLlHhVvCcSsQqTtAaZz]", re.ASCII)
+TRANSFORM_RE = re.compile(
+    r"\s*(matrix|translate|scale|rotate|skewX|skewY)\s*\(\s*([^()]*)\s*\)",
+    re.IGNORECASE,
+)
+SAFE_SEPARATORS_RE = re.compile(r"[\s,]*\Z")
+TEXT_CONTROL_RE = re.compile("[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]")
+
+COLORS = frozenset({
+    "none", "transparent", "black", "white", "red", "green", "blue",
+    "yellow", "orange", "purple", "gray", "grey", "silver", "navy",
+    "teal", "lime", "aqua", "fuchsia", "maroon", "olive", "pink",
+    "brown", "cyan", "magenta", "gold", "indigo", "coral",
+})
+FONT_FAMILIES = {
+    "arial": "Arial", "helvetica": "Helvetica", "verdana": "Verdana",
+    "tahoma": "Tahoma", "georgia": "Georgia",
+    "times new roman": "Times New Roman", "courier new": "Courier New",
+    "serif": "serif", "sans-serif": "sans-serif", "monospace": "monospace",
+    "system-ui": "system-ui",
+}
+ATTRIBUTE_OPTIONS = {
+    "fill-rule": {"evenodd", "nonzero"},
+    "stroke-linecap": {"butt", "round", "square"},
+    "stroke-linejoin": {"miter", "round", "bevel"},
+    "display": {"inline", "none"},
+    "visibility": {"visible", "hidden", "collapse"},
+    "vector-effect": {"none", "non-scaling-stroke"},
+    "font-style": {"normal", "italic", "oblique"},
+    "text-anchor": {"start", "middle", "end"},
+    "dominant-baseline": {"auto", "alphabetic", "middle", "central", "hanging", "text-before-edge", "text-after-edge"},
+    "shape-rendering": {"auto", "optimizeSpeed", "crispEdges", "geometricPrecision"},
+    "text-rendering": {"auto", "optimizeSpeed", "optimizeLegibility", "geometricPrecision"},
+}
+COORD_ATTRS = frozenset({"x", "y", "x1", "x2", "y1", "y2", "cx", "cy", "dx", "dy"})
+NONNEG_LENGTH_ATTRS = frozenset({"width", "height", "r", "rx", "ry", "stroke-width", "font-size"})
+OPACITY_ATTRS = frozenset({"opacity", "fill-opacity", "stroke-opacity"})
+OTHER_LENGTH_ATTRS = frozenset({"stroke-dashoffset", "letter-spacing", "word-spacing"})
+
+
+def _number(value: str, *, minimum: float = -10_000_000, maximum: float = 10_000_000) -> bool:
+    if len(value) > 40 or not NUMBER_RE.fullmatch(value):
+        return False
+    number = float(value)
+    return math.isfinite(number) and minimum <= number <= maximum
+
+
+def _length(value: str, *, minimum: float = -10_000_000) -> bool:
+    match = LENGTH_RE.fullmatch(value)
+    return bool(match and _number(match.group(1), minimum=minimum))
+
+
+def _number_list(value: str, *, limit: int, minimum: float = -10_000_000) -> list[str] | None:
+    """Parse whitespace/comma-separated finite numbers, never arbitrary CSS."""
+    values: list[str] = []
+    previous_end = 0
+    for match in NUMBER_RE.finditer(value):
+        between = value[previous_end:match.start()]
+        if not SAFE_SEPARATORS_RE.fullmatch(between):
+            return None
+        # Adjacent numbers are allowed only if a sign starts the next one.
+        if previous_end == match.start() and values and not match.group().startswith(("+", "-")):
+            return None
+        if not _number(match.group(), minimum=minimum):
+            return None
+        values.append(match.group())
+        if len(values) > limit:
+            return None
+        previous_end = match.end()
+    if not SAFE_SEPARATORS_RE.fullmatch(value[previous_end:]):
+        return None
+    return values or None
+
+
+def _color(value: str) -> bool:
+    if value.lower() in COLORS:
+        return True
+    if COLOR_HEX_RE.fullmatch(value) and len(value) in {4, 5, 7, 9}:
+        return True
+    match = COLOR_FUNC_RE.fullmatch(value)
+    if not match:
+        return False
+    mode, body = match.groups()
+    parts = [part.strip() for part in body.split(",")]
+    if len(parts) != (3 if mode.lower() == "rgb" else 4):
+        return False
+    for component in parts[:3]:
+        if component.endswith("%"):
+            if not _number(component[:-1], minimum=0, maximum=100):
+                return False
+        elif not _number(component, minimum=0, maximum=255):
+            return False
+    if len(parts) == 4 and not _number(parts[3], minimum=0, maximum=1):
+        return False
+    return True
+
+
+def _path(value: str, max_chars: int) -> bool:
+    if not value or len(value) > max_chars:
+        return False
+    offset = 0
+    have_move = False
+    tokens = 0
+    for match in PATH_TOKEN_RE.finditer(value):
+        if not SAFE_SEPARATORS_RE.fullmatch(value[offset:match.start()]):
+            return False
+        token = match.group()
+        if token.isalpha():
+            if not have_move:
+                if token not in "Mm":
+                    return False
+                have_move = True
+        elif not _number(token):
+            return False
+        tokens += 1
+        if tokens > 20_000:
+            return False
+        offset = match.end()
+    return have_move and SAFE_SEPARATORS_RE.fullmatch(value[offset:]) is not None
+
+
+def _transform(value: str) -> bool:
+    if not value or len(value) > 512:
+        return False
+    counts = {"matrix": {6}, "translate": {1, 2}, "scale": {1, 2}, "rotate": {1, 3}, "skewx": {1}, "skewy": {1}}
+    offset = 0
+    functions = 0
+    while offset < len(value):
+        match = TRANSFORM_RE.match(value, offset)
+        if not match:
+            return False
+        parts = _number_list(match.group(2), limit=6)
+        if parts is None or len(parts) not in counts[match.group(1).lower()]:
+            return False
+        functions += 1
+        if functions > 16:
+            return False
+        offset = match.end()
+        if not value[offset:].strip():
+            return True
+    return functions > 0
+
+
+def _viewbox(value: str) -> bool:
+    values = _number_list(value, limit=4)
+    return bool(values and len(values) == 4 and float(values[2]) > 0 and float(values[3]) > 0)
+
+
+def _aspect_ratio(value: str) -> bool:
+    parts = value.split()
+    if parts and parts[0] == "defer":
+        parts = parts[1:]
+    return (len(parts) == 1 and parts[0] == "none") or (
+        len(parts) in (1, 2)
+        and parts[0] in {
+            "xMinYMin", "xMidYMin", "xMaxYMin",
+            "xMinYMid", "xMidYMid", "xMaxYMid",
+            "xMinYMax", "xMidYMax", "xMaxYMax",
+        }
+        and (len(parts) == 1 or parts[1] in {"meet", "slice"})
+    )
+
+
+def _attribute(name: str, value: str, limits: Limits) -> str | None:
+    """Return a safe (possibly normalized) attribute value, or None."""
+    if not value or len(value) > limits.max_attribute_chars:
+        return None
+    value = value.strip()
+    if not value or TEXT_CONTROL_RE.search(value):
+        return None
+
+    if name in {"fill", "stroke"}:
+        return value if _color(value) else None
+    if name in OPACITY_ATTRS:
+        return value if _number(value, minimum=0, maximum=1) else None
+    if name in COORD_ATTRS | OTHER_LENGTH_ATTRS:
+        return value if _length(value) else None
+    if name in NONNEG_LENGTH_ATTRS:
+        return value if _length(value, minimum=0) else None
+    if name == "stroke-miterlimit":
+        return value if _number(value, minimum=1) else None
+    if name == "stroke-dasharray":
+        if value == "none":
+            return value
+        # Dasharray supports numbers and a very limited unit syntax here.
+        values = _number_list(value, limit=64, minimum=0)
+        return value if values else None
+    if name in ATTRIBUTE_OPTIONS:
+        return value if value in ATTRIBUTE_OPTIONS[name] else None
+    if name == "font-weight":
+        if value in {"normal", "bold", "bolder", "lighter"}:
+            return value
+        return value if value in {str(n) for n in range(100, 1000, 100)} else None
+    if name == "font-family":
+        parts = [part.strip().strip("\"'").lower() for part in value.split(",")]
+        if not (1 <= len(parts) <= 5) or any(part not in FONT_FAMILIES for part in parts):
+            return None
+        return ", ".join(FONT_FAMILIES[part] for part in parts)
+    if name == "viewBox":
+        return value if _viewbox(value) else None
+    if name == "preserveAspectRatio":
+        return value if _aspect_ratio(value) else None
+    if name == "points":
+        numbers = _number_list(value, limit=20000)
+        return value if numbers is not None and len(numbers) >= 2 and len(numbers) % 2 == 0 else None
+    if name == "d":
+        return value if _path(value, limits.max_path_chars) else None
+    if name == "transform":
+        return value if _transform(value) else None
+    if name == "rotate":  # tspan rotation, one numeric angle only
+        return value if _number(value) else None
+    return None
+
+
+def _tag_parts(tag: str) -> tuple[str | None, str]:
+    if tag.startswith("{"):
+        namespace, name = tag[1:].split("}", 1)
+        return namespace, name
+    return None, tag
+
+
+def _clean_text(value: str | None) -> str | None:
+    return TEXT_CONTROL_RE.sub("", value) if value is not None else None
+
+
+def _check_complexity(root: ET.Element, limits: Limits) -> None:
+    stack = [(root, 1)]
+    nodes = text_chars = 0
+    while stack:
+        node, depth = stack.pop()
+        nodes += 1
+        if nodes > limits.max_nodes or depth > limits.max_depth:
+            raise SVGValidationError("SVG exceeds element-count or nesting-depth limits")
+        if len(node.attrib) > limits.max_attributes_per_node:
+            raise SVGValidationError("SVG exceeds per-element attribute count limit")
+        if any(len(key) > 256 or len(value) > limits.max_attribute_chars for key, value in node.attrib.items()):
+            raise SVGValidationError("SVG has oversized attributes")
+        text_chars += len(node.text or "") + len(node.tail or "")
+        if text_chars > limits.max_text_chars:
+            raise SVGValidationError("SVG contains too much text")
+        stack.extend((child, depth + 1) for child in node)
+
+
+def _can_contain(parent: str, child: str) -> bool:
+    if parent in CONTAINERS:
+        return child in (CONTAINERS | SHAPES | {"text"})
+    if parent in TEXT_TAGS:
+        return child == "tspan"
+    return False
+
+
+def sanitize_svg(data: str | bytes, *, limits: Limits = DEFAULT_LIMITS) -> str:
+    """Return a rebuilt, self-contained, passive SVG document.
+
+    No CSS, URLs, links, event handlers, animation, scripts, resource references,
+    foreign elements, or XML entities survive. Unsupported subtrees are removed.
+    Malformed XML, DTDs, entities, wrong roots, and oversized inputs are rejected.
+
+    This is defense-in-depth, not a browser isolation boundary. Prefer rendering
+    sanitized output in an <img> with a restrictive CSP and untrusted origin.
+    """
+    if not isinstance(data, (str, bytes)):
+        raise TypeError("data must be str or bytes")
+    if len(data if isinstance(data, bytes) else data.encode("utf-8")) > limits.max_input_bytes:
+        raise SVGValidationError("SVG input exceeds byte limit")
+
+    try:
+        root = SafeET.fromstring(data, forbid_dtd=True, forbid_entities=True, forbid_external=True)
+    except (ET.ParseError, DefusedXmlException, UnicodeError) as exc:
+        raise SVGValidationError("Malformed or forbidden SVG/XML document") from exc
+
+    namespace, name = _tag_parts(root.tag)
+    if name != "svg" or namespace not in {None, SVG_NS}:
+        raise SVGValidationError("Input must have an SVG root element")
+
+    _check_complexity(root, limits)
+    clean_root = ET.Element(f"{{{SVG_NS}}}svg")
+    stack = [(root, clean_root, "svg")]
+    while stack:
+        original, clean, current_tag = stack.pop()
+        for key, value in original.attrib.items():
+            # Reject namespaced attributes, including xlink:href and xml:base.
+            if key.startswith("{") or ":" in key:
+                continue
+            if key not in PRESENTATION and key not in GEOMETRY[current_tag]:
+                continue
+            safe_value = _attribute(key, value, limits)
+            if safe_value is not None:
+                clean.set(key, safe_value)
+
+        if current_tag in TEXT_TAGS:
+            clean.text = _clean_text(original.text)
+
+        children_to_visit: list[tuple[ET.Element, ET.Element, str]] = []
+        for child in original:
+            child_ns, child_name = _tag_parts(child.tag)
+            if (child_ns == namespace and child_name in ALLOWED_TAGS
+                    and _can_contain(current_tag, child_name)):
+                child_out = ET.SubElement(clean, f"{{{SVG_NS}}}{child_name}")
+                children_to_visit.append((child, child_out, child_name))
+
+            # 'tail' belongs to the parent text flow, not to a removed element.
+            # Preserve that harmless visible text; never copy removed subtree text.
+            if current_tag in TEXT_TAGS and child.tail:
+                tail = _clean_text(child.tail)
+                if len(clean):
+                    previous = clean[-1]
+                    previous.tail = (previous.tail or "") + (tail or "")
+                else:
+                    clean.text = (clean.text or "") + (tail or "")
+
+        stack.extend(reversed(children_to_visit))
+
+    output = ET.tostring(clean_root, encoding="unicode", short_empty_elements=True)
+    if len(output.encode("utf-8")) > limits.max_output_bytes:
+        raise SVGValidationError("Sanitized SVG exceeds output byte limit")
+    return output

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/PKG-INFO

@@ -0,0 +1,160 @@
+Metadata-Version: 2.4
+Name: svg-sanitize
+Version: 0.1.0
+Summary: Strict, passive-only SVG reconstruction/sanitization prototype
+Author-email: Alexandre Dulaunoy <a@foo.be>
+License: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: defusedxml<1,>=0.7.1
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+# svg-sanitize — restrictive, visual-only SVG sanitizer (prototype)
+
+`svg-sanitize` rebuilds untrusted SVG as **static vector graphics only**. It does
+not simply search and replace `script` tags. It parses XML with `defusedxml`,
+checks resource limits, and constructs an entirely new XML tree from a small,
+explicit allowlist of elements, attributes, and valid values.
+
+**Prototype, not a formally verified security boundary.** Review, fuzz and test
+against your target SVG renderers before using this in a security-sensitive
+production system.
+
+## Why svg-sanitize?
+
+The **svg-sanitize** project started following security reviews conducted by **Jeroen Pinoy**, which highlighted the potential security risks associated with handling untrusted SVG files. This initial prototype was done during the hack.lu 2026 hackathon after the hot ones interview ;-)
+
+Although SVG is primarily an image format, it can contain active content, including JavaScript, event handlers, external resource references, and other potentially malicious elements. This makes SVG a potential attack vector, particularly when displaying user-supplied images in web applications.
+
+**svg-sanitize** is a lightweight Python library designed to transform untrusted SVG files into passive, visual-only SVG documents. Instead of attempting to identify every possible malicious payload, the library follows a strict allowlist approach, preserving only elements and attributes required for static vector graphics.
+
+The objective is to provide a simple, reusable, and open-source security component that reduces the attack surface when processing SVG files, without requiring applications to implement their own SVG sanitization logic.
+
+## Installation
+
+```bash
+python -m pip install -e './svg-sanitize[test]'
+# or, when inside the extracted directory:
+python -m pip install -e '.[test]'
+```
+
+Python 3.10+; the only runtime dependency is `defusedxml`.
+
+## Python usage
+
+```python
+from svg_sanitize import sanitize_svg, SVGValidationError
+
+untrusted_svg = b'''<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">
+  <script>alert(1)</script>
+  <rect width="80" height="40" fill="red"/>
+</svg>'''
+
+try:
+    passive_svg = sanitize_svg(untrusted_svg)
+except SVGValidationError as exc:
+    print(f"SVG rejected: {exc}")
+else:
+    print(passive_svg)
+    # <svg xmlns="http://www.w3.org/2000/svg"><rect width="80" height="40" fill="red" /></svg>
+```
+
+For custom input and rendering limits:
+
+```python
+from svg_sanitize import Limits, sanitize_svg
+
+output = sanitize_svg(untrusted_svg, limits=Limits(max_input_bytes=100_000, max_nodes=1_000))
+```
+
+## CLI
+
+```bash
+svg-sanitize examples/malicious.svg -o clean.svg
+# alternatively:
+python -m svg_sanitize examples/malicious.svg -o clean.svg
+```
+
+Run tests:
+
+```bash
+python -m pytest -q
+```
+
+## CI and PyPI releases
+
+The [GitHub Actions workflow](.github/workflows/ci.yml) runs the tests on Python
+3.10–3.14 for pull requests, pushes to `main`, and published GitHub releases.
+After the tests pass, it builds and checks both the source distribution and wheel.
+Only a published release triggers an upload to PyPI, using those checked artifacts.
+
+Before the first release:
+
+1. Create a GitHub Actions environment named `pypi` in this repository. Add any
+   desired deployment protection rules there.
+2. Configure a [PyPI trusted publisher](https://docs.pypi.org/trusted-publishers/)
+   for the `svg-sanitize` project with owner `adulau`, repository `svg-sanitize`,
+   workflow filename `ci.yml`, and environment name `pypi`. If the project does not
+   exist yet, configure a pending publisher in your PyPI account instead.
+
+No PyPI API token or GitHub repository secret is required. For each release,
+update `project.version` in `pyproject.toml`, merge the change, then create and
+publish a GitHub release from that commit with a matching tag, such as `v0.1.0`
+or `0.1.0`. A mismatched tag fails before publishing. Each upload must use a new
+version because PyPI does not allow replacing previously uploaded files.
+Published prereleases also run this workflow; drafts do not.
+
+## What is allowed
+
+Only `svg`, `g`, `rect`, `circle`, `ellipse`, `line`, `polyline`, `polygon`,
+`path`, `text`, and `tspan`. Numeric dimensions and coordinates, path data,
+point lists, limited transforms, limited named/hex/rgb colors, static stroke/
+fill and selected text formatting properties are validated individually.
+
+SVGs using gradients, filters, clipping paths, `<use>`, images, embedded fonts,
+CSS, masks, symbols, hyperlinks, animation or scripting **will lose those
+features**. In particular, gradient fills `fill="url(#id)"` are discarded,
+including local URLs. This is an explicit security/functionality tradeoff.
+
+## What is forbidden
+
+- JavaScript and scriptable elements; `onload`, `onclick`, and all event handlers.
+- CSS (`<style>`, `style=`), including `@import`, `url(...)`, and expressions.
+- All links and resources, including `href`, `xlink:href`, external and internal
+  references, `data:` URLs, `<image>`, `<use>`, fonts, filters and gradients.
+- `<foreignObject>` and arbitrary/HTML/XML namespace elements.
+- SVG animation and SMIL (`animate`, `set`, `animateTransform`, etc.).
+- DTDs, XML entity declarations, external entity references, malformed XML.
+- Unknown attributes (including `id`, `class`, `xml:base`, and `xmlns:xlink`).
+
+Unknown elements are removed **with their complete subtrees**; the input is
+never copied wholesale to output. The implementation also enforces limits on
+input bytes, output bytes, node count, depth, attribute sizes and text sizes.
+
+## Deployment advice
+
+For untrusted-user uploads, make the sanitized document only one defense layer:
+
+1. Keep the original SVG out of any publicly served directory.
+2. Serve the sanitized output with `Content-Type: image/svg+xml`, ideally from
+   a separate cookieless domain with `Content-Disposition: attachment` for
+   downloads. For display, prefer `<img src="...">` rather than inline SVG.
+3. Use CSP restricting `script-src 'none'; object-src 'none'; base-uri 'none';
+   default-src 'none'; img-src 'self' data:` on the serving endpoint where
+   appropriate, and ensure application CSP is also restrictive.
+4. Treat the output as untrusted in any subsequent XML/SVG manipulation pipeline;
+   downstream software might add back risky features. If preserving more complex
+   SVG features is necessary, consider rasterizing with a hardened, resource-
+   isolated renderer instead of broadening the allowlist.
+5. Use browser-based regression tests, fuzz tests, and multiple-engine testing
+   before relying on the package for production security.
+
+**No SVG sanitizer can promise protection against all future rendering-engine
+vulnerabilities.** This prototype targets active-content injection and external
+resource-loading pathways, not malicious graphical impersonation or renderer
+memory-corruption bugs.
+
+MIT licensed (see `LICENSE`).

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/svg_sanitize/__init__.py
+src/svg_sanitize/__main__.py
+src/svg_sanitize/sanitizer.py
+src/svg_sanitize.egg-info/PKG-INFO
+src/svg_sanitize.egg-info/SOURCES.txt
+src/svg_sanitize.egg-info/dependency_links.txt
+src/svg_sanitize.egg-info/entry_points.txt
+src/svg_sanitize.egg-info/requires.txt
+src/svg_sanitize.egg-info/top_level.txt
+tests/test_sanitizer.py

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+svg-sanitize = svg_sanitize.__main__:main

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/requires.txt

@@ -0,0 +1,4 @@
+defusedxml<1,>=0.7.1
+
+[test]
+pytest>=7

svg_sanitize-0.1.0/src/svg_sanitize.egg-info/top_level.txt

@@ -0,0 +1 @@
+svg_sanitize

svg_sanitize-0.1.0/tests/test_sanitizer.py

@@ -0,0 +1,192 @@
+import re
+import xml.etree.ElementTree as ET
+
+import pytest
+
+from svg_sanitize import Limits, SVGValidationError, sanitize_svg
+
+SVG = "http://www.w3.org/2000/svg"
+PREFIX = f'<svg xmlns="{SVG}">'
+
+
+def svg(body: str, extra: str = "") -> str:
+    return f'<svg xmlns="{SVG}" {extra}>{body}</svg>'
+
+
+def tags(xml: str) -> list[str]:
+    return [element.tag.split("}")[-1] for element in ET.fromstring(xml).iter()]
+
+
+def test_basic_geometry_and_presentation_survive():
+    source = svg('''<g transform="translate(1, 2)" opacity="0.9">
+        <rect width="100" height="50" fill="#abc"/>
+        <circle cx="20" cy="20" r="8" stroke="rgb(12, 34, 56)"/>
+        <path d="M0 0 L10 10 Z" fill="none" stroke-width="2"/>
+    </g>''', 'width="200" height="100" viewBox="0 0 200 100"')
+    clean = sanitize_svg(source)
+    assert tags(clean) == ["svg", "g", "rect", "circle", "path"]
+    assert 'viewBox="0 0 200 100"' in clean
+    assert 'transform="translate(1, 2)"' in clean
+    assert 'stroke="rgb(12, 34, 56)"' in clean
+
+
+@pytest.mark.parametrize("payload,needle", [
+    ('<script>alert(1)</script><rect width="5" height="5"/>', "script"),
+    ('<style>@import url(https://bad.example/a.css)</style>', "style"),
+    ('<foreignObject><script xmlns="http://www.w3.org/1999/xhtml">bad()</script></foreignObject>', "foreignObject"),
+    ('<a href="javascript:alert(1)"><text>Clickable</text></a>', "a"),
+    ('<use href="https://bad.example/x.svg#thing"/>', "use"),
+    ('<image href="data:image/svg+xml;base64,xyz"/>', "image"),
+    ('<animate attributeName="href" to="javascript:alert(1)"/>', "animate"),
+    ('<set attributeName="onload" to="alert(1)"/>', "set"),
+    ('<filter><feImage href="https://bad.example/"/></filter>', "filter"),
+    ('<defs><linearGradient id="g"/></defs>', "defs"),
+    ('<metadata><script>alert(1)</script></metadata>', "metadata"),
+])
+def test_executable_or_ref_elements_removed(payload, needle):
+    result = sanitize_svg(svg(payload))
+    assert tags(result) == (["svg", "rect"] if '<rect width="5"' in payload else ["svg"])
+    assert needle not in result
+    assert "bad.example" not in result
+    assert "javascript:" not in result
+
+
+def test_event_handlers_and_unknown_attrs_removed():
+    result = sanitize_svg(svg('<rect width="5" height="6" onload="alert(1)" '
+                              'onclick="alert(2)" data-a="1" class="x" id="foo"/>', 'onload="alert(1)"'))
+    assert tags(result) == ["svg", "rect"]
+    for value in ("onload", "onclick", "alert", "data-a", "class", "id="):
+        assert value not in result
+
+
+def test_discard_css_and_url_values():
+    result = sanitize_svg(svg('''<rect width="12" height="13"
+        style="fill:url(http://bad.example/img);background:url(javascript:evil())"
+        fill="url(https://bad.example/fill.svg#f)"
+        stroke="url(#foo)"
+        filter="url(https://bad.example/svg#filter)"
+        font-family="url(http://bad.example/font.woff)"/>
+    '''))
+    for item in ("url(", "style=", "filter=", "stroke=", "fill=", "font-family=", "bad.example"):
+        assert item not in result
+    assert 'width="12"' in result
+
+
+def test_foreign_and_namespaced_attributes_removed():
+    source = f'''<svg xmlns="{SVG}" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <rect width="2" height="2" xlink:href="javascript:alert(1)" xml:base="https://bad.example"/>
+        <script xmlns="http://www.w3.org/1999/xhtml">evil()</script>
+    </svg>'''
+    result = sanitize_svg(source)
+    assert tags(result) == ["svg", "rect"]
+    assert "xlink" not in result and "xml:base" not in result
+    assert "bad.example" not in result and "script" not in result
+
+
+def test_text_and_tspan_survive_escaped():
+    result = sanitize_svg(svg('<text x="2" y="14">Hi &amp; <tspan font-weight="bold">&lt;svg&gt;</tspan>!</text>'))
+    assert tags(result) == ["svg", "text", "tspan"]
+    assert "Hi &amp;" in result
+    assert "&lt;svg&gt;" in result
+    assert "!</text>" in result
+
+
+def test_removed_text_descendant_does_not_propagate_active_content():
+    output = sanitize_svg(svg('<text>Hello<script>alert(1)</script> World</text>'))
+    assert tags(output) == ["svg", "text"]
+    assert "Hello World" in output
+    assert "alert" not in output
+
+
+def test_dtd_and_entities_rejected():
+    malicious = (f'<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'
+                 f'<svg xmlns="{SVG}"><text>&xxe;</text></svg>')
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(malicious)
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(f'<!DOCTYPE svg><svg xmlns="{SVG}"/>')
+
+
+def test_processing_instructions_are_not_forwarded():
+    doc = f'''<?xml version="1.0"?>
+    <?xml-stylesheet href="https://bad.example/style.css" type="text/css"?>
+    <svg xmlns="{SVG}"><circle r="3"/></svg>'''
+    result = sanitize_svg(doc)
+    assert "xml-stylesheet" not in result
+    assert "bad.example" not in result
+    assert tags(result) == ["svg", "circle"]
+
+
+def test_invalid_xml_and_wrong_root_rejected():
+    for payload in ("<svg><g></svg>", "<html></html>", '<svg xmlns="http://evil.example/svg"/>'):
+        with pytest.raises(SVGValidationError):
+            sanitize_svg(payload)
+
+
+def test_resource_limits():
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(svg(' ' * 200), limits=Limits(max_input_bytes=30))
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(svg('<g/>' * 5), limits=Limits(max_nodes=3))
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(svg('<g><g><g/></g></g>'), limits=Limits(max_depth=3))
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(svg('<text>123456</text>'), limits=Limits(max_text_chars=4))
+    with pytest.raises(SVGValidationError):
+        sanitize_svg(svg('<rect width="2" height="3"/>'), limits=Limits(max_output_bytes=20))
+
+
+def test_invalid_geometry_is_dropped():
+    result = sanitize_svg(svg('<rect x="1e309" width="-5" height="50" opacity="2" '
+                              'transform="translate(0);evil()" fill="expression(alert(1))"/>'))
+    assert tags(result) == ["svg", "rect"]
+    assert 'height="50"' in result
+    assert all(x not in result for x in (' x=', 'width=', 'opacity=', 'transform=', 'fill=', 'evil'))
+
+
+def test_path_and_polyline_validation():
+    good = sanitize_svg(svg('<path d="M0 0 L50 50 Z"/><polyline points="0,0 20,20 40,0"/>'))
+    assert 'd="M0 0 L50 50 Z"' in good and 'points="0,0 20,20 40,0"' in good
+    bad = sanitize_svg(svg('<path d="M0 0 javascript:alert(1)"/><polygon points="0,0 1,evil"/>'))
+    assert ' d=' not in bad and ' points=' not in bad
+
+
+def test_font_family_whitelist():
+    result = sanitize_svg(svg('<text font-family="Arial, sans-serif">A</text>'
+                              '<text font-family="local(https://bad.example)">B</text>'))
+    assert 'font-family="Arial, sans-serif"' in result
+    assert "bad.example" not in result
+
+
+def test_non_namespaced_input_is_rewritten_into_svg_namespace():
+    cleaned = sanitize_svg('<svg><rect width="10" height="20"/></svg>')
+    assert f'xmlns="{SVG}"' in cleaned
+    assert tags(cleaned) == ["svg", "rect"]
+
+
+def test_idempotence():
+    doc = svg('<g transform="rotate(20 10 10)"><circle r="15" fill="blue"/></g>'
+              '<text x="20" y="30">A &amp; B</text>')
+    assert sanitize_svg(sanitize_svg(doc)) == sanitize_svg(doc)
+
+
+def test_no_suspicious_active_content_can_survive_sample():
+    from pathlib import Path
+    input_file = Path(__file__).parent.parent / "examples" / "malicious.svg"
+    result = sanitize_svg(input_file.read_bytes())
+    assert tags(result) == ["svg", "rect", "text"]
+    for danger in ("script", "style", "foreignObject", "image", "alert(", "onload", "onclick",
+                   "http://example.invalid", "href", "url(", "javascript:"):
+        assert danger not in result
+    assert "Harmless visible text" in result
+
+
+def test_control_bidi_removed_from_visible_text():
+    clean = sanitize_svg(svg('<text>ABC\u202eDEF</text>'))
+    assert "ABCDEF" in clean and "\u202e" not in clean
+
+
+def test_types():
+    with pytest.raises(TypeError):
+        sanitize_svg(10)
+    assert '<circle' in sanitize_svg(svg('<circle r="5"/>').encode("utf-8"))