fix: svgs are now being saved

[battlemag5]

This PR is for the proposed solution for the issue: #84

[battlemag5]

Might be related to #49
Not sure if I understood what mindmap is correctly

[ZimengXiong]

Allowing data:image/svg+xml through the sanitizer unconditionally is too broad; SVG payloads need tighter validation than the other image formats here.

A safer approach would be to only preserve SVG data URLs after decoding and validating the SVG content itself, for example by rejecting active content (<script>, event handlers, external references, unsafe foreignObject, etc.) and only allowing a constrained subset back into data:image/svg+xml.

[ZimengXiong]

Thanks for the PR.

Allowing data:image/svg+xml through the sanitizer unconditionally is too broad; SVG payloads need tighter validation than the other image formats here.

A safer approach would be to only preserve SVG data URLs after decoding and validating the SVG content itself, for example by rejecting active content (<script>, event handlers, external references, unsafe foreignObject, etc.) and only allowing a constrained subset back into data:image/svg+xml.

[battlemag5]

hey @ZimengXiong
Sorry for absence, I'm not well versed in typescript, so I don't think I'll be able to deliver this pr comparatively well

[ZimengXiong]

No problem, I'll take it over. Thanks for contributing!

…

On Apr 14, 2026, at 22:04:35, battlemag5 ***@***.***> wrote: battlemag5 left a comment (ZimengXiong/ExcaliDash#86) <#86 (comment)> hey @ZimengXiong <https://github.com/ZimengXiong> Sorry for absence, I'm not well versed in typescript, so I don't think I'll be able to deliver this pr comparatively well — Reply to this email directly, view it on GitHub <#86 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AT7G33H3M3QN7V4ANMDJREL4V4J6HAVCNFSM6AAAAACWFLTROGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DENBZGM2DMNJZHA>. You are receiving this because you were mentioned.