Listen to this Post
SiYuan cleans user-supplied SVG with util.SanitizeSVG.
This acts as the primary guard behind Editor.AllowSVGScript.
The setting is off by default, so script tags should be removed.
The cleaner reads input using an HTML parser.
However, the browser reads the served file as XML/SVG.
This parser mismatch between HTML and XML is the core flaw.
HTML has integration points like and <>.
Inside these, the HTML parser switches back to normal HTML mode.
HTML also has raw text elements: