How svgin-react renders SVGs as real, styleable elements without the XSS risk
Say you're fetching an SVG from somewhere you don't fully control. A CMS field, a user upload, an API response. Is it safe to render? Most people never actually think about this until it bites them, because "SVG" sounds like an image format, not something that can run code. The img tag is fine < img src = { cmsIconUrl } width = { 24 } /> This is safe. When a browser loads an SVG through img , it…
When fetching SVGs from an untrusted source, such as a CMS field or user upload, rendering them without proper sanitization can lead to cross-site scripting (XSS) attacks. SVGs may appear harmless as they are typically treated as image resources by browsers, containing no JavaScript execution or event handling. However, styling SVGs requires inlining the markup into the DOM, which then exposes it to XSS risks like onload handlers, javascript: URIs, and malicious event attributes.
Sanitizing SVGs before rendering is crucial to prevent these attacks. Libraries like DOMPurify offer SVG profiles specifically designed for this purpose, stripping out dangerous attributes and URIs while preserving the SVG's visual content. The key is to sanitize the SVG markup every single time it is fetched and rendered, integrating it into the default behavior of rendering tools rather than treating it as an optional step.
The SvgIn component from the svgin-react library automates this process. It fetches an SVG file, sanitizes it with DOMPurify by default, and renders a real, styleable SVG element in the DOM, allowing CSS styling and animations. This approach ensures that the SVG is treated with the same level of caution as if it were raw HTML, regardless of how it is fetched or rendered, whether on the client or server side.
By making sanitization a mandatory part of the rendering process, developers can confidently use SVGs without the risk of XSS vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
