SVG / publication review / local guide
Record external references, script or event-handler execution risks, and unresolved URLs separately. Make a static confirmation note without rendering, executing, or sending SVG.
Before publishing, review SVG as text rather than displaying it in a browser. A reference and executable content are different findings.
reference: image href="https://example.invalid/a.png"
execution-risk: <script> or onload="..."
unresolved: url(#local-id) or relative/path.png
decision: fix / remove / verify before publish| Category | Review |
|---|---|
| external-reference | Check href, xlink:href, and CSS url() for external origins. Do not fetch them. |
| execution-risk | Route script elements and event attributes to removal or specialist review. |
| unresolved | Keep relative URLs, fragments, and variables unresolved until their source and publication condition are confirmed. |
| local-reference | Keep safe same-document definitions separate from external references and confirm they are needed. |
This page does not render, execute, or upload SVG. Do not infer safety from an unverified reference.
| case | decision | request |
|---|---|---|
external-reference | external-reference | Remove the external origin or confirm an approved bundled asset. |
script-element | execution-risk | Remove script and keep the SVG static. |
event-handler | execution-risk | Remove onload or other event attributes. |
unresolved-relative-url | unresolved | Confirm source and publication resolution conditions. |
safe-local-reference | local-reference | Confirm the same-document reference is needed. |
unsupported-upload | reject | Reject a review request that requires upload or execution. |
Do not paste production SVG, tokens, or personal data into this guide. Use synthetic cases and handle real files through the existing approval process.