mirror of
https://github.com/svg/svgo.git
synced 2025-04-19 10:22:15 +03:00
28 lines
1.0 KiB
Plaintext
28 lines
1.0 KiB
Plaintext
---
|
|
title: removeScripts
|
|
svgo:
|
|
pluginId: removeScripts
|
|
---
|
|
|
|
Removes all scripts from the document.
|
|
|
|
SVGs can be interactive through JavaScript. However, unless the SVG is coming from a trusted source, it's strongly advised to strip off JavaScript to avoid [XSS](https://developer.mozilla.org/docs/Glossary/Cross-site_scripting) attacks.
|
|
|
|
:::caution
|
|
|
|
This **will** break interactive SVGs that rely on JavaScript.
|
|
|
|
:::
|
|
|
|
This plugin performs the following operations:
|
|
|
|
- Removes [`<script>`](https://developer.mozilla.org/docs/Web/SVG/Element/script) elements.
|
|
- Removes [SVG event attributes](https://developer.mozilla.org/docs/Web/SVG/Attribute/Events), such as `onload`, `onclick`, and `oninput`, preserving the element itself.
|
|
- Collapses [`<a>`](https://developer.mozilla.org/docs/Web/SVG/Element/a) elements, moving children up to the parent element.
|
|
|
|
:::info
|
|
|
|
Between v3 and v4, the plugin was renamed from `removeScriptElement` to `removeScripts` to reflect that it does more than just remove the `<script>` tag.
|
|
|
|
:::
|