getgrav/grav · error · Exception

SVG could not be sanitized, it has been moved to the logs/qu

Error message

SVG could not be sanitized, it has been moved to the logs/quarantine folder

What it means

Error "SVG could not be sanitized, it has been moved to the logs/quarantine folder" thrown in getgrav/grav.

Source

Thrown at system/src/Grav/Common/Security.php:136

     */
    public static function sanitizeSVG(string $file): void
    {
        if (file_exists($file) && Grav::instance()['config']->get('security.sanitize_svg')) {
            $sanitizer = new DOMSanitizer(DOMSanitizer::SVG);
            $sanitizer->addDisallowedAttributes(['href', 'xlink:href']);
            $original_svg = file_get_contents($file);
            $clean_svg = $sanitizer->sanitize($original_svg);

            // Quarantine bad SVG files and throw exception
            if ($clean_svg !== false ) {
                file_put_contents($file, $clean_svg);
            } else {
                $quarantine_file = Utils::basename($file);
                $quarantine_dir = 'log://quarantine';
                Folder::mkdir($quarantine_dir);
                file_put_contents("$quarantine_dir/$quarantine_file", $original_svg);
                unlink($file);
                throw new Exception('SVG could not be sanitized, it has been moved to the logs/quarantine folder');
            }
        }
    }

    /**
     * Detect XSS code in Grav pages
     *
     * @param Pages $pages
     * @param bool $route
     * @param callable|null $status
     * @return array
     */
    public static function detectXssFromPages(Pages $pages, $route = true, ?callable $status = null)
    {
        $routes = $pages->getList(null, 0, true);

        // Remove duplicate for homepage
        unset($routes['/']);

View on GitHub (pinned to 6040efed04)

When it happens

Trigger: Thrown at system/src/Grav/Common/Security.php:136 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getgrav/grav@6040efed04 (2026-08-17). Data as JSON: /api/errors/69fdc6c48f92d7ed. Report an issue: GitHub.