SVG sanitizer bypass: javascript: href on anchor elements survives sanitization

Summary

There is a cross-site scripting (XSS) vulnerability in imgproxy's SVG sanitization logic. When IMGPROXY_SANITIZE_SVG is enabled, the sanitizer correctly strips dangerous tags and event handler attributes, but it fails to filter javascript: scheme URIs in href attributes on `` elements. This means a malicious SVG containing a clickable link with a javascript: payload will pass through sanitization completely intact, and any downstream application that treats the output as safe HTML could expose its users to XSS.

Details

The problem is that the href-stripping logic in svg.go (lines 113–122) was written specifically to handle elements — a known SVG attack vector — but the same dangerous pattern is possible on elements too. When the server receives an SVG containing , the sanitizer walks the element tree, checks whether the tag is a blocked element like `script` or `iframe`, strips any `on*` event handler attributes listed in `unsafe_attrs.go`, and then only removes the `href` if the current tag happens to be `use`. Because the code checks the tag name before deciding whether to strip `href`, an element with a javascript: URI simply isn't covered. The malicious href survives sanitization unchanged and appears in the output as if it were legitimate. A direct imgproxy response does include a CSP sandbox header that provides some protection, but any downstream consumer that embeds or re-serves the sanitized SVG content without that header is f…