fix: sanitize SVG

[DeepDiver1975]

Description

SVG xlink:href will now completely be blocked as well as other image tag to harden SVG support.

Motivation and Context

Harden SVG support

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:
• Changelog item, see TEMPLATE

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
62.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[IljaN]

Is it possible to pin this specifically to commit: rhukster/dom-sanitizer@757e4d6

[DeepDiver1975]

The explicit commit is pinned in compose.lock

[IljaN]

Won't this automatically pull HEAD on every composer install on a fresh system?

[DeepDiver1975]

no -composer install operate on the lock file. lock file is updated via composer update

dont get confused with npm .....

[IljaN]

✔️

[IljaN]

✔️

[DeepDiver1975]

damit - changelog is missing .... will come up with another pr ...