Sanitise an SVG — it is a document, not a picture

Four things a picture should not be able to do

• A beacon

  A reference to an image on someone else's server. Every time the file is opened, that server is contacted — which tells its owner when, and from roughly where. This is the closest thing to a tracking pixel that fits inside a picture.

• Executable code

  Inside the image file.

• Editor traces

  Illustrator and Inkscape write their own namespaces into the file, including layer names and local filesystem paths.

• Whole raster images

  Embedded as text — and those carry their own EXIF, which is why the cleaner recurses into them instead of stopping at the outer file.

Source: the SVG 2 specification on embedded images.

An allowlist, not a blocklist. Only the elements and attributes that draw the picture survive. Anything else is dropped, including markup invented after this was written.