and - and * , which carries arbitrary HTML, and all three were confirmed * executing in a browser. It also missed unquoted handlers and '], 'use pulling an external document' => [''], 'an image with a data url' => [''], ]; } #[DataProvider('payloads')] public function test_nothing_executable_survives(string $svg): void { $clean = $this->sanitize($svg); foreach (['script', 'onerror', 'onload', 'onclick', 'javascript:', 'foreignObject', 'assertStringNotContainsStringIgnoringCase( $forbidden, $clean, "[{$forbidden}] survived sanitising", ); } } /** * And the logo still looks like a logo afterwards. * * A sanitiser that empties everything is safe and useless. Gradients in * particular are what an over-eager strip tends to break. */ public function test_a_real_logo_keeps_its_shape(): void { $clean = $this->sanitize( '' ); foreach (['viewBox="0 0 24 24"', 'linearGradient', 'stop-color="#f00"', 'd="M2 2 L22 22"', 'fill="url(#g)"', 'Acme'] as $kept) { $this->assertStringContainsString($kept, $clean, "[{$kept}] was stripped from a legitimate logo"); } } /** Markup that will not parse yields nothing rather than passing through. */ public function test_unparseable_markup_yields_nothing(): void { $this->assertSame('', $this->sanitize('