sanitize style tags before passing to dom-sanitizer

duncanmcclean · duncanmcclean · commit b31835577f81 · 2026-04-13T09:16:17.000+01:00
diff --git a/src/Support/Svg.php b/src/Support/Svg.php
@@ -20,11 +20,11 @@ public static function sanitize(string $svg, ?DOMSanitizer $sanitizer = null): s
     {
         $sanitizer = $sanitizer ?? new DOMSanitizer(DOMSanitizer::SVG);
 
-        $svg = $sanitizer->sanitize($svg, [
+        $svg = static::sanitizeStyleTags($svg);
+
+        return $sanitizer->sanitize($svg, [
             'remove-xml-tags' => ! Str::startsWith($svg, '<?xml'),
         ]);
-
-        return static::sanitizeStyleTags($svg);
     }
 
     public static function sanitizeCss(string $css): string

Original file line number	Diff line number	Diff line change
`@@ -20,11 +20,11 @@ public static function sanitize(string $svg, ?DOMSanitizer $sanitizer = null): s`
`20`	`20`	`{`
`21`	`21`	`$sanitizer = $sanitizer ?? new DOMSanitizer(DOMSanitizer::SVG);`
`22`	`22`
`23`		`- $svg = $sanitizer->sanitize($svg, [`
	`23`	`+ $svg = static::sanitizeStyleTags($svg);`
	`24`	`+`
	`25`	`+ return $sanitizer->sanitize($svg, [`
`24`	`26`	`'remove-xml-tags' => ! Str::startsWith($svg, '<?xml'),`
`25`	`27`	`]);`
`26`		`-`
`27`		`- return static::sanitizeStyleTags($svg);`
`28`	`28`	`}`
`29`	`29`
`30`	`30`	`public static function sanitizeCss(string $css): string`