title: Is there any way to make user uploaded SVG images safe from code injection etc?
body: <p>I want to display user uploaded SVG images on a website, but they're quite open to exploits:</p>
  
  <ul>
  <li><a href="https://security.stackexchange.com/questions/11384/exploits-or-other-security-risks-with-svg-upload">https://security.stackexchange.com/questions/11384/exploits-or-other-security-risks-with-svg-upload</a></li>
  <li><a href="https://security.stackexchange.com/questions/36447/img-tag-vulnerability">https://security.stackexchange.com/questions/36447/img-tag-vulnerability</a></li>
  </ul>
  
  <p>For example, <a href="https://html5sec.org/#47" rel="noreferrer">arbitrary javascript can be embedded in SVG</a>. There's also issues with performance exploits, but I'd consider those lower priority.</p>
  
  <p>Is there any mechanism to make SVG somewhat safe and only use it as an image? Can I simply trust <code>&lt;img src="/media/user-uploaded-image.svg" /&gt;</code>?</p>
  
  <p>Wikipedia/Wikimedia Commons hosts SVG files. Does anyone know what measures they take to prevent SVG exploits?</p>