Skip to content

Check an SVG for active content

Check an SVG for active content: script elements, on* event handlers, remote references, javascript: links, embedded data URIs and style pulls.

svgauditsecurityscripts

Upload

Files (1–1)
One SVG (or XML) file, up to 8 MB. The audit never renders, executes or fetches anything; entities are refused, not expanded.
Questions people ask
What counts as active content in an SVG?
Script elements, on* event-handler attributes, SVG Tiny handler elements, javascript: links, foreignObject containers and remote references href'd from the file. Each is reported with the element path, and the verdict folds the classes together.
Is anything executed, rendered or fetched?
No. The audit reads the file as text with a capped parser. Nothing is rendered in a browser, no script is run, and remote references are recorded with their scheme and target but never contacted. The job has no network access at all.
What happens to XML entities in the file?
They are refused, not expanded. The first megabyte is pre-scanned for entity declarations: if one is found, the audit stops with a clear error, because expanding entities is how crafted files leak data or blow parsers up. A plain file with no entity declarations audits normally.
Why does the report state script sizes but never script text?
Because the size is what matters for the risk picture, and the text is where payloads and spoilers live. The aggregate byte count of every script element is reported; the contents never appear in the audit, the result or the download.
A clean result is not a safety certificate, though?
Correct. Clean means the structures this audit looks for are absent. It does not guarantee browser safety: rendering environments, browser bugs and combinations of ordinary features are outside a static audit. Treat it as a fast look, not an approval.
What are the limits?
One file up to 8 MB. Nesting is capped at 512 levels (deeper files are refused) and the walk stops counting structures past 20,000 elements, which the report states. Malformed XML is refused with the parser's error position, and entity-bearing files are refused outright.