Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor JavaScript apps that insert untrusted SVG into the DOM, DOMPurify is the strongest general starting point in the available documentation: it explicitly supports SVG and sanitizes parsed markup with element and attribute allow-lists. sanitize-html is another option when its configurable policies fit the SVG features your app needs. Neither choice replaces validation: check XML and SVG conformance separately, and never treat well-formed XML as proof that markup is safe to render.
Sanitizing SVG and validating SVG are different jobs
Sanitization applies a security policy to markup, removing or restricting elements and attributes that should not reach a rendering context. Validation checks whether the document meets a defined structural or conformance target. That target might be XML well-formedness, namespace correctness, a particular SVG profile, or an application-specific allow-list; “valid SVG” alone is too vague to be useful.
The W3C SVG 2 conformance criteria distinguish conformance classes. For example, an SVG DOM subtree must be rooted in the SVG namespace and follow the applicable element and attribute rules. An XML-compatible fragment also needs to be well-formed, namespace-conformant, and use valid XML IDs. A standalone SVG file has its own requirements, including a well-formed XML document and a conforming SVG root subtree.
Passing an XML parser or schema check does not make content safe: active markup can be well-formed. Conversely, sanitizing markup does not establish that the result meets every SVG rule. The W3C media-type registration for SVG says processors should expect well-formed XML, but cannot assume that input is valid against a particular DTD or schema, or that every element and attribute is recognized.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Which SVG sanitizer should you choose?
| Option | Best fit | Documented behavior and cautions |
|---|---|---|
| DOMPurify | JavaScript applications inserting SVG into browser DOM contexts | Explicitly supports SVG, parses markup into an inert DOM, and applies element and attribute allow-lists, including URI checks. It is not a CSS sanitizer, and its output is not safe for every context. |
| sanitize-html | Applications that need configurable tag, attribute, and URL-scheme policies | Its documentation describes configurable policies and special handling for SVG animation that targets URL attributes. Allowing script or style can expose an application to XSS; review and test the exact configuration. |
AngularJS $sanitize |
Maintaining an existing AngularJS application | SVG subset support is optional, and the documentation warns about click-jacking risks and unsafe allow-list extensions. Official support for AngularJS ended in January 2022, making this a legacy consideration rather than a default for new work. |
| Laravel SVG Sanitizer | Laravel/PHP projects evaluating an SVG-specific package | The maintainer documents an SVG allow-list and blocking examples for scripts, event handlers, JavaScript URLs, foreignObject, external references, and data URLs. Treat these as project claims and verify implementation and activity before production use. |
There is no independent performance benchmark or hands-on comparison behind these options. Choose by runtime, parsing model, required SVG features, URL/resource policy, and maintenance—not an unsupported claim that one is fastest or preserves the most features.
DOMPurify: a practical starting point, with context limits
DOMPurify documents support for HTML, SVG, and MathML. Its approach is to parse markup into a DOM, walk the resulting nodes, apply element and attribute allow-lists, check URI-bearing attributes, and serialize the sanitized result. Its documentation also describes namespace checks and defenses against mutation XSS. For a web app accepting SVG that will be inserted into the DOM, this makes it a well-supported general starting point.
Its security boundary matters. DOMPurify says it is not a CSS sanitizer. It also warns that output sanitized for one markup context may become unsafe if moved into SVG, XML, an attribute, or raw-text context. Modifying sanitized output—or passing it through a library that mutates it—can undo protections. Keep sanitization close to the rendering sink and use a policy designed for that sink. If CSS is not required, DOMPurify documents forbidding style elements and attributes.
DOMPurify enables SANITIZE_DOM by default to help prevent DOM clobbering through collisions with built-in APIs and properties. OWASP’s DOM Clobbering Prevention Cheat Sheet notes that SANITIZE_NAMED_PROPS can also be enabled to protect custom variables and properties.
When sanitize-html may fit better
sanitize-html exposes configurable allowed tags, attributes, and URL schemes, which can be useful when an app needs an explicit feature policy. Its documentation describes a particular SVG safeguard: if SVG animation elements are enabled, an animation targeting a URL attribute is discarded because animation could change the target URL after sanitization.
Do not enable dangerous features merely to retain arbitrary input. The package documentation warns that allowing script or style can expose the application to cross-site scripting. Review current documentation, define the SVG profile your product accepts, and test the exact configuration against that profile.
Make the SVG feature policy explicit
SVG is more than shapes and paths. Links and external references, CSS, filters, animation, and foreignObject can change the security and functionality trade-offs. OWASP ASVS 4.0.2 requirement 5.2.7 specifically says: “Verify that the application sanitizes, disables, or sandboxes user-supplied Scalable Vector Graphics (SVG) scriptable content, especially as they relate to XSS resulting from inline scripts, and foreignObject.” See the OWASP ASVS 4.0.2 V5.2.
Before choosing settings, decide which of these features the product actually needs:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Scripts and event attributes: generally disable or remove for user-supplied artwork unless a carefully isolated use case requires them.
foreignObject: decide whether embedded foreign content is necessary; OWASP explicitly identifies it as a concern in scriptable SVG.- Links and external resources: specify acceptable URL schemes and whether remote resources are allowed. Check handling of
href,xlink:href, data URLs, and protocol-relative URLs. - CSS and styles: decide whether inline styles or style elements are required, and use a policy that addresses CSS separately from markup sanitization.
- Filters and animation: test the required features with the selected sanitizer; URL-changing animation can undermine assumptions about a sanitized target.
Build a pipeline for the actual rendering context
There is no single pipeline that fits every deployment. An SVG inserted inline into a page, loaded as an image, served as a standalone document, or transformed server-side has different context and isolation needs. DOMPurify’s security guidance emphasizes that moving sanitized output into another context can change its safety properties.
- Set input limits and parsing expectations. Enforce file-size and parsing constraints appropriate to the application before processing untrusted input.
- Parse without executing active content. Use a parsing path appropriate to the runtime; do not render raw input as a shortcut to validation.
- Sanitize for the intended sink. Apply an explicit allow-list and URL/resource policy that preserves only the SVG features the product needs.
- Validate separately if conformance is required. Name the target precisely: well-formed XML, a defined SVG profile, standalone-file requirements, or the application’s accepted subset.
- Render or serve with suitable controls. Consider origin and embedding controls for the chosen delivery method, and avoid post-sanitization transformations that can alter markup.
Check maintenance and advisories before deployment
Sanitizer behavior and package security status can change. OWASP’s Cross Site Scripting Prevention Cheat Sheet recommends regularly patching sanitization libraries as browsers change and bypasses are discovered. Check current releases, supported runtimes, and security advisories for the exact version you plan to deploy.
For example, the GitHub advisories page for svg-sanitizer lists multiple advisories, including entries dated September 1, 2026. That is a reason to inspect each advisory’s affected and fixed versions—not by itself a blanket judgment about the package or every release.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
