---
schema_version: "1"
id: 9ff49d1e257e5d4e13daf7febcc6f720d5a04455c72e7834204c756820e51afd
title: How Lightning Web Security Sanitizes Static Resources in SVG Elements
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-sanitize-svg-static-resource.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg-static-resource.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 098171f2b3b26bbf1db6cb0ca119e196561e592ae9f6c4c303cd87c0a5576bb9
products:
  - Security for Lightning Components
  - lwc
---
# How Lightning Web Security Sanitizes Static Resources in SVG Elements

**important:** LWS doesn’t [sanitize](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize.md) input text. Your code must validate or sanitize any user input.

Lightning Web Security (LWS) sanitizes resources loaded using the `<use>` tag and other SVG elements that support an `href` attribute.

For example, the URL in this `<use>` tag is sanitized.

```html
<use href="foo.svg#circle"></use>
```

LWS replaces the `href` value with a sanitized value. The sanitized URL is similar to:

```html
<use href="httplocalhostfoo_svg#circle"></use>
```

The sanitized URL is unknown outside the sandbox.

Despite the changes to the DOM, the content continues to function as expected.

**See Also**

- [SVG Allowlist for LWS](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg.md)