From 945064fceaa6e913feca07f905777ac8abe0749b Mon Sep 17 00:00:00 2001
From: Nandan Vallamdasu <nandan.vallamdasu@outlook.com>
Date: Thu, 24 Sep 2026 20:56:01 +0530
Subject: [PATCH] ui : fix missing svg use and animation elements in preview
 and download (#28962)

* ui : allow svg use and animation tags in sanitizer

* ui : neutralize href animation retargeting in svg sanitizer
---
 tools/ui/src/lib/constants/svg-blocks.constants.ts |  2 ++
 tools/ui/src/lib/utils/sanitize-svg.ts             | 11 +++++++++++
 2 files changed, 13 insertions(+)

diff --git a/tools/ui/src/lib/constants/svg-blocks.constants.ts b/tools/ui/src/lib/constants/svg-blocks.constants.ts
index 705800c262..785e5a57fb 100644
--- a/tools/ui/src/lib/constants/svg-blocks.constants.ts
+++ b/tools/ui/src/lib/constants/svg-blocks.constants.ts
@@ -41,6 +41,8 @@ export const SVG = {
 	 * so an author <style> stays scoped to that root and can not reach the page.
 	 */
 	SANITIZE_CONFIG: {
+		ADD_ATTR: ['calcMode', 'from', 'to'],
+		ADD_TAGS: ['animate', 'set', 'use'],
 		FORBID_TAGS: ['foreignObject', 'script'],
 		USE_PROFILES: { svg: true, svgFilters: true }
 	},
diff --git a/tools/ui/src/lib/utils/sanitize-svg.ts b/tools/ui/src/lib/utils/sanitize-svg.ts
index 586669adf2..c1dd20d4f7 100644
--- a/tools/ui/src/lib/utils/sanitize-svg.ts
+++ b/tools/ui/src/lib/utils/sanitize-svg.ts
@@ -1,6 +1,17 @@
 import { SVG } from '$lib/constants';
 import DOMPurify from 'dompurify';
 
+/**
+ * animate and set can retarget href or xlink:href to a javascript: uri through
+ * to, from, by or values, none of which DOMPurify checks as a uri. Dropping
+ * attributeName in that case leaves the animation inert.
+ */
+DOMPurify.addHook('uponSanitizeAttribute', (_node, data) => {
+	if (data.attrName === 'attributename' && /href$/i.test(data.attrValue.trim())) {
+		data.keepAttr = false;
+	}
+});
+
 /**
  * Sanitizes a raw svg string for safe inline rendering.
  * Returns the cleaned svg markup, or an empty string when the input is not a