easy_svg_max_use_tags

Filter · Easy SVG · Status: Stable

An SVG can repeat a shape many times with use elements, each pointing at another element by its id. Thousands of them make the cleaning step very slow even in a small file. Easy SVG counts them first and refuses the file when there are more than 1000. This filter changes that number.

Usage

apply_filters( 'easy_svg_max_use_tags', int $max )

Applied in easy-svg.php, inside easy_svg_svg_too_complex(). The result is cast to an integer.

When to use it

• A real drawing you need is refused, for example a map or a pattern sheet that repeats one symbol several thousand times, and you trust the people who upload it.
• You want to be stricter, for example 200 on a site that only stores icons.

Do not use it when:

• The file is refused for its size: use easy_svg_max_bytes.
• The sanitizer drops your use references. That is the allow-list or remote references, not this bound.

Parameters

Return value

Default

1000

Examples

Icons only, so a much lower bound

/**
 * An icon never needs hundreds of use elements.
 */
function mysite_svg_max_use_tags( $max ) {
	return 200;
}
add_filter( 'easy_svg_max_use_tags', 'mysite_svg_max_use_tags' );

A higher bound for administrators only

/**
 * Detailed maps from the design team repeat one marker a few thousand times.
 */
function mysite_svg_max_use_tags_for_admins( $max ) {
	if ( current_user_can( 'manage_options' ) ) {
		return 5000;
	}

	return $max;
}
add_filter( 'easy_svg_max_use_tags', 'mysite_svg_max_use_tags_for_admins' );

Raise, but never past a hard cap

function mysite_svg_max_use_tags_capped( $max ) {
	$wanted = defined( 'MYSITE_SVG_MAX_USE' ) ? (int) MYSITE_SVG_MAX_USE : (int) $max;

	return min( max( 0, $wanted ), 3000 );
}
add_filter( 'easy_svg_max_use_tags', 'mysite_svg_max_use_tags_capped' );

How it works

easy_svg_svg_too_complex() lowercases the raw markup and counts how often the text <use appears. It does not parse anything:

• <use, <USE and <Use all count.
• Any tag that starts with those letters counts too, and so does the text inside comments and CDATA.
• A prefixed element such as <svg:use does not count, because the text there is :use, not <use.

The file is refused when this count is greater than the filter result, or when the processing instruction count is greater than easy_svg_max_php_tags.

Why the bound exists: for each use element the sanitizer walks every element that has an id, so the work grows with both numbers multiplied together. Counting is linear and cheap, and it runs before the expensive part.

The check runs after the size check and before the sanitizer, on the same paths as the other bounds: media and REST uploads, sideloads, the add_attachment safety net (which deletes a failing attachment), XML-RPC and wp_upload_bits(), and every way into the icon library. In the media library a refused file shows "Sorry, please check your SVG file.", in the icon library "That SVG has too many parts to be read safely." The filter runs on every check and receives no information about the file or the path.

Pitfalls

• High values cost real time. The cost of cleaning grows with the number of use elements times the number of elements with an id. Doubling this bound can far more than double the worst case.
• The count is text based. Comments and unusual tag names that start with use can push a file over the bound, while prefixed svg:use elements are not counted.
• No context. Your callback cannot tell an icon from a media upload. If you need different bounds, decide by user capability or request, not by file.
• A negative value refuses everything, because a count of 0 is still greater than -1.

Related

• easy_svg_max_php_tags
• easy_svg_max_bytes
• easy_svg_svg_too_complex()
• esw_svg_allowed_tags
• esw_svg_file_checker()