test: assert excluded SVG elements are stripped as tags

Add regression vectors for the allow-list exclusions that carry a
security or external-fetch rationale - raster <image>, the <filter>
pipeline and its primitives (<feGaussianBlur>, <feImage>), and SMIL
<animate> - asserting the tag names themselves are gone, not just their
attributes. Also strengthens the animate case to check the whole tag is
removed rather than only its onbegin handler.

Addresses CodeRabbit test-coverage feedback on PR #1833.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: pattonwebz

tests/phpunit/helper-functions/SanitizeScannedHtmlTest.php

@@ -36,6 +36,7 @@ public function malicious_svg_data() {
 			'javascript: xlink'   => [ '<svg><use xlink:href="javascript:alert(1)" /></svg>', 'javascript:' ],
 			'javascript: href'    => [ '<svg><use href="javascript:alert(1)" /></svg>', 'javascript:' ],
 			'onbegin animate'     => [ '<svg><animate onbegin="alert(1)" attributeName="x" /></svg>', 'onbegin' ],
+			'animate element'     => [ '<svg><animate onbegin="alert(1)" attributeName="x" /></svg>', '<animate' ],
 			'onmouseover handler' => [ '<svg onmouseover="alert(1)"><rect width="10" height="10" /></svg>', 'onmouseover' ],
 		];
 	}
@@ -134,6 +135,34 @@ public function test_strips_svg_elements_outside_the_allow_list() {
 		$this->assertStringNotContainsString( '<textpath', $sanitized );
 	}
 
+	/**
+	 * Tests that non-rendering / scripting-adjacent SVG elements the allow-list
+	 * deliberately omits (raster <image>, the <filter> pipeline and its
+	 * primitives, and SMIL <animate>) are stripped as tags. These are called
+	 * out separately from the structural exclusions above because they are the
+	 * ones with a security or external-fetch rationale, not just "unused."
+	 */
+	public function test_strips_security_sensitive_svg_elements() {
+		$svg = '<svg viewBox="0 0 10 10">'
+			. '<image href="https://evil.example/x.svg" width="10" height="10" />'
+			. '<filter id="f"><feGaussianBlur stdDeviation="1" /><feImage href="https://evil.example/y" /></filter>'
+			. '<animate attributeName="x" from="0" to="10" />'
+			. '<rect width="10" height="10" fill="#000" />'
+			. '</svg>';
+
+		$sanitized = edac_sanitize_scanned_html( $svg );
+
+		$this->assertStringNotContainsStringIgnoringCase( '<image', $sanitized );
+		$this->assertStringNotContainsStringIgnoringCase( '<filter', $sanitized );
+		$this->assertStringNotContainsStringIgnoringCase( '<feGaussianBlur', $sanitized );
+		$this->assertStringNotContainsStringIgnoringCase( '<feImage', $sanitized );
+		$this->assertStringNotContainsStringIgnoringCase( '<animate', $sanitized );
+
+		// The benign sibling shape must still survive - excluding the above
+		// should not nuke the rest of the graphic.
+		$this->assertStringContainsString( '<rect', $sanitized );
+	}
+
 	/**
 	 * Tests that a local same-document fragment reference (the common,
 	 * legitimate icon-sprite pattern) is preserved on both href and