Table of contents
Source: admin/code/tce_functions_svg_check.php
Functions to check that uploaded SVG files contain only static graphics.
Functions
F_get_svg_allowed_attributes()
Returns the attributes without namespace accepted in uploaded SVG files.
Attributes named ‘data-’ or ‘aria-’ are also accepted; ‘href’ is checked by F_is_safe_svg_href().
function F_get_svg_allowed_attributes(): list<string>
Returns: list<string>: attribute names
Source: admin/code/tce_functions_svg_check.php:94
F_get_svg_allowed_elements()
Returns the SVG elements accepted in uploaded SVG files.
Script, foreign content, animation, link and font elements are not listed.
function F_get_svg_allowed_elements(): list<string>
Returns: list<string>: element local names
Source: admin/code/tce_functions_svg_check.php:29
F_get_svg_metadata_namespaces()
Returns the RDF metadata namespaces accepted inside the SVG ‘metadata’ element.
function F_get_svg_metadata_namespaces(): list<string>
Returns: list<string>: namespace URIs
Source: admin/code/tce_functions_svg_check.php:278
F_is_safe_svg_attribute()
Check an attribute of an uploaded SVG element.
function F_is_safe_svg_attribute(DOMElement $element, DOMAttr $attr, bool $in_metadata): bool
Parameters:
$element(DOMElement): Element that holds the attribute.$attr(DOMAttr): Attribute to check.$in_metadata(bool): True if the element is inside the SVG ‘metadata’ element.
Returns: bool: True if the attribute is accepted.
Source: admin/code/tce_functions_svg_check.php:337
F_is_safe_svg_content()
Check that an SVG file contains only static graphics.
The file must be well-formed UTF-8 XML with an ‘svg’ root element in the SVG namespace. Entity declarations, internal DTD subsets, processing instructions, elements and attributes outside the allowed lists, event handlers, external references and script URLs are rejected. Files saved as “Plain SVG” or “Optimized SVG” pass; editor-specific namespaces do not.
function F_is_safe_svg_content(string $filepath): bool
Parameters:
$filepath(string): Path of the file to check.
Returns: bool: True if the content is accepted.
Source: admin/code/tce_functions_svg_check.php:420
F_is_safe_svg_href()
Check an SVG ‘href’ or ‘xlink:href’ value.
The ‘image’ element accepts only base64 PNG, JPEG or GIF data URLs; other elements accept only fragment references (#id).
function F_is_safe_svg_href(string $element, string $value): bool
Parameters:
$element(string): Local name of the element that holds the attribute.$value(string): Attribute value.
Returns: bool: True if the value is accepted.
Source: admin/code/tce_functions_svg_check.php:318
F_is_safe_svg_node()
Check the child nodes of an uploaded SVG document or element.
Only elements, text, CDATA sections and comments are accepted; elements must be listed in F_get_svg_allowed_elements(), or belong to an RDF metadata namespace inside ‘metadata’.
function F_is_safe_svg_node(DOMNode $node, bool $in_metadata): bool
Parameters:
$node(DOMNode): Document or element to check.$in_metadata(bool): True if the node is inside the SVG ‘metadata’ element.
Returns: bool: True if all child nodes are accepted.
Source: admin/code/tce_functions_svg_check.php:369
F_is_safe_svg_value()
Check that an SVG attribute value or style sheet contains no external reference or script.
url() references must point to a fragment (#id); CSS escapes, @import, image(), image-set(), cross-fade(), src(), expression(), behaviors, bindings and script URLs are rejected.
function F_is_safe_svg_value(string $value): bool
Parameters:
$value(string): Attribute value or style sheet text.
Returns: bool: True if the value is accepted.