easy_svg_neutralize_href_animation()
Removes animation elements that would set an href or an on* handler.
Function · Easy SVG · Status: Internal · Defined in easy-svg.php
Internal: not part of the promised public surface. It may change without notice.
Usage
easy_svg_neutralize_href_animation( string $markup ): string
Example
$safe = easy_svg_neutralize_href_animation( $clean );
if ( '' === $safe ) {
$safe = $clean;
}
Description
A no-op on the default allow-list, which has no animation elements. When a site widens esw_svg_allowed_tags to animate or set, the sanitizer still checks attribute names only, so attributeName="href" could set a javascript: URL. This removes animate, set, animateColor, animateMotion and animateTransform whose attributeName is href, xlink:href or starts with on. Prefixed elements are matched by local name.
Parameters
body
$markupstring
Already sanitized SVG markup.
Return value
returnstring
Markup without href-driving animation, or an empty string when unparseable.
Related
Was this page helpful?