- How do I install enshrined/svg-sanitize in a Laravel application?
- Install it with Composer by running composer require enshrined/svg-sanitize. There is no official Laravel service provider, so you typically bind the Sanitizer class as a singleton in a service provider or resolve it directly. The package is pure PHP and has no framework-specific dependencies, so installation does not require extra Laravel configuration.
- Does enshrined/svg-sanitize work with Laravel 11 and PHP 8?
- The package requires PHP 7.2+ and the DOM/libxml extensions, and it is compatible with Laravel and Symfony because it has no framework dependencies. It does not publish Laravel-specific version constraints, so standard Composer compatibility rules apply. Check your Laravel version's PHP requirement against the package's PHP 7.2+ floor before installing.
- How do I sanitize SVG uploads before saving them with Storage::put in Laravel?
- Resolve the sanitizer in a controller, form request, custom validation rule, or upload middleware and call sanitize() on the file contents before Storage::put(). For example, read the uploaded SVG, pass it to sanitize(), and only store the returned string when it is not false. Keeping the sanitizer in Laravel's container as a singleton makes it easy to reuse across upload paths.
- Can I customize which SVG tags and attributes are allowed?
- Yes. You can call setAllowedTags() and setAllowedAttrs() with your own whitelist implementations of TagInterface and AttributeInterface. This lets you permit project-specific SVG elements or lock down the defaults further. Custom whitelists are useful when your application accepts a narrower set of SVG features than the package allows by default.
- How do I stop SVGs from loading remote references and causing HTTP leaks?
- Call removeRemoteReferences(true) on the sanitizer before sanitizing. This strips attributes that point to remote files and helps prevent HTTP leaks from untrusted SVGs. The package notes that this option adds roughly 15% overhead, so enable it when outbound references are a real concern.
- What should I do when sanitize() returns false for malformed SVG?
- sanitize() returns boolean false when the XML cannot be parsed, which usually means the SVG is badly formatted. Capture libxml errors before the call and use getXmlIssues() afterward to collect details about what happened. Treat false as a rejection and do not store or serve the original dirty SVG.
- How do I minify the sanitized SVG output?
- Enable minification with $sanitizer->minify(true) before calling sanitize(). It reduces the size of the sanitized XML output, which can help with storage and bandwidth. Minification does not improve sanitization speed because the package is CPU-bound during processing.
- Is enshrined/svg-sanitize suitable for production and actively maintained?
- It is used in real-world integrations such as the WordPress Safe SVG plugin and Drupal modules, so the core sanitization approach has production exposure. However, GitHub activity has been low with the last commit around September 2023, and there is no enterprise support option. For critical upload paths, plan to review issues internally and monitor the repository rather than relying on fast upstream fixes.
- What license does enshrined/svg-sanitize use, and can I use it in a commercial Laravel product?
- The package is GPL-2.0 licensed, which can conflict with proprietary or commercial software policies. If you are building a closed-source Laravel product, have legal review the license before adopting it. The technical integration is straightforward, but licensing is the main adoption gate for commercial teams.
- How does enshrined/svg-sanitize perform when processing many SVGs per second?
- Sanitization is CPU-bound; minify(true) reduces output size but does not speed up processing. The package notes that remote reference blocking adds about 15% overhead, and for volumes above roughly 50 SVGs per second you should use queues or cache sanitized results. Load-test with representative SVGs, including malformed and script-containing samples, before relying on it at peak traffic.