ASSET_SVG_UNSAFE: SVG with active content
| Severity | Fault | Stage |
|---|---|---|
| error | customer (the source package) | build output |
What it means
Section titled “What it means”An SVG the component imports has something that runs code or loads another URL: a <script>, an on… event handler, <foreignObject>, a link (<a>), an animation that changes a link or a handler, a reference to another file or URL (href, xlink:href, url(…), @import, xml-stylesheet), an embedded SVG or anything other than a raster data: image. SVG assets are published on the CDN, where a browser can open them as a page, so the build refuses them instead of rewriting them. Comments, metadata and editor data (Inkscape, Illustrator) are removed, not refused.
How to fix
Section titled “How to fix”Remove what the message names: an icon or illustration needs no script, handler or external file. Point href and url() at an id of the same SVG (#gradient), embed raster images as data:image/png;base64, and do interactivity in the component’s code instead of the SVG.