KLXM Studio – Home
Get in touch

Demo · SVG in the media library

Vector graphics, pin sharp.

SVG files stay sharp on every screen and are often just a few kilobytes. Because SVG can also contain scripts and references, KLXM Studio sanitises every file on upload.

Example

An illustration as SVG

Our own demo illustration, about 2 KB – enlarge it with a click: no jaggies, no blur.

  • Illustration: flat landscape with a windmill, river, poplars and a low sun – enlarge
    Lower Rhine – windmill, poplars, river (SVG, own illustration)

Sanitising

What gets removed on upload

A deliberately crafted test file (not uploaded, for illustration only) – left as submitted, right as KLXM Studio would store it.

  • Submitted

    Script, onload, javascript: link, embedded iframe, external image, CSS behavior, animation, editor data and an external entity.

    test.svg
    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY x SYSTEM "file:///etc/passwd"> ]>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" width="200" height="200" onload="alert('onload')">
  <metadata>Editor-Daten</metadata>
  <script>alert('script')</script>
  <a xlink:href="javascript:alert('link')"><circle cx="100" cy="100" r="80" fill="#581D47" inkscape:label="Kreis"/></a>
  <foreignObject width="200" height="200"><iframe xmlns="http://www.w3.org/1999/xhtml" src="https://example.com/"></iframe></foreignObject>
  <image href="https://example.com/tracker.png" width="1" height="1"/>
  <rect x="60" y="60" width="80" height="80" fill="#EDE9E3" style="behavior:url(x.htc)"/>
  <animate attributeName="fill" to="red" dur="1s"/>
</svg>

  • Stored

    What remains is the circle and the square: 844 B → 201 B, 7 unsafe items removed.

    test.svg
    <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200">
<circle cx="100" cy="100" r="80" fill="#581D47"/>
<rect x="60" y="60" width="80" height="80" fill="#EDE9E3"/>
</svg>

How it works

Allow list instead of hope.

  • Rebuilt

    The file is rebuilt as a new document – only allowed elements and attributes are kept. Scripts, on… attributes, foreignObject, external references and animations are not.

  • Optimised

    Editor data, comments and unused definitions are dropped, numbers shortened; title, desc and ARIA stay for accessibility.

  • Belt and braces

    SVG is delivered as an image (<img>) plus strict headers on direct access. Embedded pixel images are rejected on upload.

More demos

Try more.

All examples at a glance – with demo data you can safely try out.

All demosTutorials