How Lightning Web Security Sanitizes Static Resources in SVG Elements
LWS doesn’t sanitize input text. Your code must validate or sanitize any user input.
Lightning Web Security (LWS) sanitizes resources loaded using the <use> tag and other SVG elements that support an href attribute.
For example, the URL in this <use> tag is sanitized.
1<use href="foo.svg#circle"></use>
LWS replaces the href value with a sanitized value. The sanitized URL is similar to:
1<use href="httplocalhostfoo_svg#circle"></use>
The sanitized URL is unknown outside the sandbox.
Despite the changes to the DOM, the content continues to function as expected.
See Also
This release is in preview. Features described here don't become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can't guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.
j