feat(ui-svg-images): add allowUseElement prop to InlineSVG - #2661
Open
joyenjoyer wants to merge 1 commit into
Open
feat(ui-svg-images): add allowUseElement prop to InlineSVG#2661joyenjoyer wants to merge 1 commit into
joyenjoyer wants to merge 1 commit into
Conversation
Allow <use> elements restricted to same-document fragment references, so SVG sprite sheets render. External URLs, data: and javascript: schemes stay blocked. The default behaviour is unchanged, with <use> still stripped.
Contributor
|
Contributor
Visual regression report
Diff images (33)alert.png — baseline no longer producedavatar.png — baseline no longer producedbadge.png — baseline no longer producedbillboard.png — baseline no longer producedbreadcrumb.png — baseline no longer producedbutton-and-derivatives.png — baseline no longer producedbyline.png — baseline no longer producedcalendar.png — baseline no longer producedcheckbox.png — baseline no longer producedcheckboxgroup.png — baseline no longer producedcolorpicker.png — baseline no longer producedcontextview.png — baseline no longer producedcustom-and-lucide-icons.png — baseline no longer produceddateinput-dateinput2.png — baseline no longer produceddatetimeinput.png — baseline no longer produceddiff-demo.png — 6324 pixels differdrilldown.png — baseline no longer producedfiledrop.png — baseline no longer producedform-errors.png — baseline no longer producedheading.png — baseline no longer producedimg.png — baseline no longer producedlink.png — baseline no longer producedmenu.png — baseline no longer producedmetric-pill-tag-timeselect-text.png — baseline no longer producedoptions.png — baseline no longer producedpagination.png — baseline no longer producedprogressbar.png — baseline no longer producedselect-simpleselect.png — baseline no longer producedtable.png — baseline no longer producedtabs.png — baseline no longer producedtooltip.png — baseline no longer producedtreebrowser.png — baseline no longer producedview.png — baseline no longer producedBaselines come from the |
There was a problem hiding this comment.
Pull request overview
Adds an opt-in allowUseElement prop to InlineSVG (in ui-svg-images) so callers can preserve SVG <use> elements while restricting href / xlink:href to same-document fragment references (#id). This supports sprite-sheet style SVG usage while keeping the default behavior (stripping <use>) unchanged.
Changes:
- Extend
sanitizeSvgto accept anallowUseElementoption that conditionally permits<use>plushref/xlink:href, and adds a fragment-only enforcement hook. - Add
allowUseElementtoInlineSVGprops and plumb it through to sanitization. - Document the new prop in the InlineSVG README and add unit tests covering default stripping and opt-in behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/ui-svg-images/src/InlineSVG/sanitizeSvg.ts | Adds allowUseElement sanitization option and fragment-only enforcement hook for <use> references. |
| packages/ui-svg-images/src/InlineSVG/README.md | Documents allowUseElement with a live sprite-sheet <use> example. |
| packages/ui-svg-images/src/InlineSVG/props.ts | Adds the new allowUseElement prop and includes it in allowedProps. |
| packages/ui-svg-images/src/InlineSVG/index.tsx | Wires allowUseElement into the sanitizeSvg call path. |
| packages/ui-svg-images/src/InlineSVG/tests/sanitizeSvg.test.tsx | Adds coverage for <use> stripping by default and fragment-only behavior when enabled. |
| packages/ui-svg-images/src/InlineSVG/tests/InlineSVG.test.tsx | Adds integration coverage ensuring <use> rendering only occurs when the prop is set. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+66
to
+69
| if (options?.allowUseElement) { | ||
| config.ADD_TAGS = ['use'] | ||
| config.ADD_ATTR = ['href', 'xlink:href'] | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
allowUseElementprop toInlineSVG, permitting<use>elements restricted to same-document fragment refs (#id). Default is unchanged,<use>is still stripped.afterSanitizeAttributeshook.Test Plan
<use>elements": the first SVG should show three colored circles, the second (no prop) should be blank.Fixes INSTUI-5117
🤖 Generated with Claude Code