---
schema_version: "1"
id: 6d3a982661e2d949a749ea992f53b99c26a0ea29c0fd15d7e43761e46f9ec52b
title: SVG Allowlist for Lightning Web Security
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-sanitize-svg.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 7936caf7616e900ec5f9cfc2486981b59a273c9b01b616d2feedc94f1b9e8a82
products:
  - Security for Lightning Components
  - lwc
---
# SVG Allowlist for Lightning Web Security

SVG can be targeted by cross-site scripting (XSS) attacks due to its permissive approach to loading and executing external resources. To prevent XSS attacks, Lightning Web Security (LWS) applies SVG sanitization rules when it encounters potentially malicious content.

**important:** LWS doesn’t [sanitize](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize.md) input text. Your code must validate or sanitize any user input.

The SVG language includes an extensive list of [elements](https://developer.mozilla.org/en-US/docs/Web/SVG/Element) that you can use inside the `<svg>` tag.

Here is a list of elements that LWS considers safe and allows to remain in an `svg` element after sanitization. LWS removes elements that aren’t in this list.

- `a, altglyph, altglyphdef, altglyphitem, animatecolor, animatemotion, animatetransform, audio`
- `canvas, circle, clippath`
- `defs, desc`
- `ellipse`
- `filter, font`
- `g, glyph, glyphref`
- `hkern`
- `image`
- `line, lineargradient`
- `marker, mask, mpath`
- `path, pattern, polygon, polyline`
- `radialgradient, rect`
- `stop, switch, symbol`
- `text, textpath, title, tref, tspan`
- `use`
- `video, view, vkern`

For example, this `svg` element contains a `g` element, which is allowed, and a `script` element, which isn’t allowed.

```html
<svg>
  <g></g>
  <script></script>
</svg>
```

After sanitization, this code becomes:

```html
<svg><g></g></svg>
```

**See Also**

- [How LWS Sanitizes Static Resources in SVG Elements](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg-static-resource.md)