fix: preserve SVG <use> elements and href attributes in sanitization by 24f2006299 · Pull Request #8520 · marimo-team/marimo

24f2006299 · 2026-02-28T21:24:25Z

Summary

SVGs containing <defs> and <use> elements (common in Matplotlib SVG output) were not rendering correctly when displayed via image/svg+xml MIME type. DOMPurify was stripping <use> elements and their href/xlink:href attributes during sanitization.

Changes

Added ADD_TAGS: ["use"] and ADD_ATTR: ["href", "xlink:href"] to the DOMPurify config in sanitize.ts. This preserves SVG <use> elements and their reference attributes while keeping all other sanitization intact.

javascript: protocol in href attributes is still blocked by DOMPurify at the protocol level, so this does not introduce XSS risk.

Test Plan

Updated sanitize.test.ts:

Changed existing test from asserting <use> removal to asserting preservation
Added test for the full <defs> + <use> SVG pattern (matching the issue reproduction case)

Closes marimo-team#8316 DOMPurify was stripping <use> elements and their href/xlink:href attributes during sanitization, breaking SVGs that define shapes in <defs> and reference them via <use> (common in Matplotlib SVG output). Add "use" to ADD_TAGS and "href"/"xlink:href" to ADD_ATTR in the DOMPurify config so these elements survive sanitization.

vercel · 2026-02-28T21:24:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview, Comment	Mar 3, 2026 6:39pm

github-actions · 2026-02-28T21:24:34Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

24f2006299 · 2026-02-28T21:27:14Z

I have read the CLA Document and I hereby sign the CLA

Copilot

Pull request overview

Updates the frontend HTML/SVG sanitization settings to preserve SVG <use> elements (and their reference attributes) so SVGs that rely on <defs> + <use>—such as common Matplotlib SVG output—render correctly when displayed as image/svg+xml.

Changes:

Allowlist the SVG <use> tag in the DOMPurify configuration.
Allowlist href and xlink:href attributes to preserve <use> references.
Update and extend sanitizer tests to assert <use> preservation and cover a <defs> + <use> pattern.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
frontend/src/plugins/core/sanitize.ts	Updates DOMPurify config to preserve SVG `<use>` and `href`/`xlink:href` attributes.
frontend/src/plugins/core/test/sanitize.test.ts	Updates tests to expect `<use>` preservation and adds a `<defs>` + `<use>` regression case.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T13:13:36Z

frontend/src/plugins/core/sanitize.ts

+    // Allow SVG <use> elements and their href attributes, which are needed
+    // for SVGs that reference <defs> (e.g., Matplotlib SVG output).
+    ADD_TAGS: ["use"],
+    ADD_ATTR: ["href", "xlink:href"],


Now that <use> and href/xlink:href are explicitly allowlisted, we should add a regression test that sanitizeHtml still strips dangerous URI schemes for these attributes on <use> specifically (e.g., href="javascript:..." and xlink:href="javascript:..."). The existing SVG URI tests cover <a>, but not <use>, which is the newly-enabled surface area.

Copilot · 2026-03-02T13:13:36Z

frontend/src/plugins/core/__test__/sanitize.test.ts

+    const html =
+      '<svg width="60" height="60"><circle cx="30" cy="30" r="30" fill="orange"></circle><defs><circle id="myCircle" cx="0" cy="0" r="10" fill="green"></circle></defs><use href="#myCircle" x="20" y="20"></use></svg>';
+    expect(sanitizeHtml(html)).toMatchInlineSnapshot(
+      `"<svg width="60" height="60"><circle cx="30" cy="30" r="30" fill="orange"></circle><defs><circle id="myCircle" cx="0" cy="0" r="10" fill="green"></circle></defs><use href="#myCircle" x="20" y="20"></use></svg>"`,
+    );


The SVG string in this test is a single very long line, which makes it difficult to read and update. Consider formatting it as a multiline template literal (or otherwise wrapping it) so future diffs are more reviewable and the intent is clearer.

Suggested change

const html =

'<svg width="60" height="60"><circle cx="30" cy="30" r="30" fill="orange"></circle><defs><circle id="myCircle" cx="0" cy="0" r="10" fill="green"></circle></defs><use href="#myCircle" x="20" y="20"></use></svg>';

expect(sanitizeHtml(html)).toMatchInlineSnapshot(

`"<svg width="60" height="60"><circle cx="30" cy="30" r="30" fill="orange"></circle><defs><circle id="myCircle" cx="0" cy="0" r="10" fill="green"></circle></defs><use href="#myCircle" x="20" y="20"></use></svg>"`,

);

const html = `

<svg width="60" height="60">

<circle cx="30" cy="30" r="30" fill="orange"></circle>

<defs>

<circle id="myCircle" cx="0" cy="0" r="10" fill="green"></circle>

</defs>

<use href="#myCircle" x="20" y="20"></use>

</svg>

`;

expect(sanitizeHtml(html)).toMatchInlineSnapshot(`

"<svg width=\"60\" height=\"60\">

<circle cx=\"30\" cy=\"30\" r=\"30\" fill=\"orange\"></circle>

<defs>

<circle id=\"myCircle\" cx=\"0\" cy=\"0\" r=\"10\" fill=\"green\"></circle>

</defs>

<use href=\"#myCircle\" x=\"20\" y=\"20\"></use>

</svg>"

`);

…lements Address review feedback: - Add tests verifying javascript: href and xlink:href are stripped from <use> - Reformat defs+use SVG test string as array join for readability

for more information, see https://pre-commit.ci

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T17:27:03Z

frontend/src/plugins/core/__test__/sanitize.test.ts

+      `"<svg><use></use></svg>"`,
+    );
  });



The new <use> coverage verifies javascript: is stripped, but it doesn’t exercise non-javascript: external references (e.g. https://...#id or data:image/svg+xml,...). Adding a test that asserts external/non-fragment href/xlink:href values are removed (if that’s the intended security posture) would help prevent regressions and clarify the expected behavior for <use>.

Suggested change

test("removes external href from SVG use element", () => {

const html =

'<svg><use href="https://example.com/sprite.svg#icon"></use></svg>';

expect(sanitizeHtml(html)).toMatchInlineSnapshot(

`"<svg><use></use></svg>"`,

);

});

test("removes external xlink:href from SVG use element", () => {

const html =

'<svg><use xlink:href="https://example.com/sprite.svg#icon"></use></svg>';

expect(sanitizeHtml(html)).toMatchInlineSnapshot(

`"<svg><use></use></svg>"`,

);

});

test("removes data URI href from SVG use element", () => {

const html =

'<svg><use href="data:image/svg+xml,%3Csvg%3E%3C/svg%3E"></use></svg>';

expect(sanitizeHtml(html)).toMatchInlineSnapshot(

`"<svg><use></use></svg>"`,

);

});

github-actions · 2026-03-03T18:48:53Z

🚀 Development release published. You may be able to view the changes at https://marimo.app?v=0.20.3-dev94

24f2006299 requested review from Light2Dark and manzt as code owners February 28, 2026 21:24

vercel bot deployed to Preview February 28, 2026 21:25 View deployment

vercel bot deployed to Preview February 28, 2026 21:27 View deployment

Light2Dark requested review from mscolnick and removed request for Light2Dark March 2, 2026 05:12

mscolnick requested review from Copilot and removed request for manzt and mscolnick March 2, 2026 13:08

Copilot started reviewing on behalf of mscolnick March 2, 2026 13:09 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

test: add security regression tests for javascript: URIs on SVG use e…

94b135f

…lements Address review feedback: - Add tests verifying javascript: href and xlink:href are stripped from <use> - Reformat defs+use SVG test string as array join for readability

24f2006299 force-pushed the fix/svg-use-elements branch from 2b71611 to 94b135f Compare March 2, 2026 16:30

vercel bot deployed to Preview March 2, 2026 16:32 View deployment

Light2Dark added the bug Something isn't working label Mar 2, 2026

[pre-commit.ci] auto fixes from pre-commit.com hooks

22a9443

for more information, see https://pre-commit.ci

vercel bot deployed to Preview March 2, 2026 16:36 View deployment

mscolnick previously approved these changes Mar 2, 2026

View reviewed changes

mscolnick requested a review from Copilot March 2, 2026 17:22

Copilot started reviewing on behalf of mscolnick March 2, 2026 17:23 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

update

0fb748d

mscolnick dismissed their stale review via 0fb748d March 3, 2026 18:38

vercel bot deployed to Preview March 3, 2026 18:39 View deployment

mscolnick merged commit e90e721 into marimo-team:main Mar 3, 2026
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: preserve SVG <use> elements and href attributes in sanitization#8520

fix: preserve SVG <use> elements and href attributes in sanitization#8520
mscolnick merged 4 commits intomarimo-team:mainfrom
24f2006299:fix/svg-use-elements

24f2006299 commented Feb 28, 2026

Uh oh!

vercel bot commented Feb 28, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 28, 2026 •

edited

Loading

Uh oh!

24f2006299 commented Feb 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 2, 2026

Uh oh!

Copilot AI Mar 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 2, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

24f2006299 commented Feb 28, 2026

Summary

Changes

Test Plan

Uh oh!

vercel bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

24f2006299 commented Feb 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel bot commented Feb 28, 2026 •

edited

Loading

github-actions bot commented Feb 28, 2026 •

edited

Loading