siyuan-note/siyuan · error

svg contains too many tokens

Error message

svg contains too many tokens

What it means

SanitizeSVG counts every XML token it processes and aborts once the count exceeds maxSVGTokens (1,000,000, kernel/util/misc.go:322). This is a resource-exhaustion guard: a huge or deliberately pathological SVG must not consume unbounded CPU/memory during sanitization. Hitting it means the input is either genuinely enormous or adversarially constructed.

Source

Thrown at kernel/util/misc.go:362

	encoder := xml.NewEncoder(&buf)
	rootSeen := false
	rootClosed := false
	depth := 0
	skipDepth := 0
	tokenCount := 0
	var elementStack []xml.Name

	for {
		token, err := decoder.RawToken()
		if err == io.EOF {
			break
		}
		if err != nil {
			return "", fmt.Errorf("parse svg failed: %w", err)
		}
		tokenCount++
		if tokenCount > maxSVGTokens {
			return "", fmt.Errorf("svg contains too many tokens")
		}

		switch typed := token.(type) {
		case xml.StartElement:
			elementStack = append(elementStack, typed.Name)
			depth++
			if depth > maxSVGDepth {
				return "", fmt.Errorf("svg nesting depth exceeds %d", maxSVGDepth)
			}
			if rootClosed {
				return "", fmt.Errorf("svg contains multiple root elements")
			}
			if !rootSeen {
				if !strings.EqualFold(typed.Name.Local, "svg") {
					return "", fmt.Errorf("root element is not svg")
				}
				rootSeen = true
			}

View on GitHub (pinned to 8641553a1f)

Solutions

1. Simplify/optimize the SVG before import (reduce path points, merge shapes, run SVGO or similar)
2. Split or downscale the artwork — icons should be small vector graphics, not full illustrations
3. If the source is trusted and legitimately large, increase maxSVGTokens consciously and accept the DoS tradeoff
4. Reject the asset upstream with a friendlier size check (e.g. file-size or element-count limit) before sanitization

Example fix

// before
out, err := util.SanitizeSVG(hugeGeneratedSVG)
// after
if countElements(hugeGeneratedSVG) > 100000 {
    return errors.New("icon too complex; please simplify the SVG")
}
out, err := util.SanitizeSVG(hugeGeneratedSVG)

if strings.Count(svg, "<") > 100000 { return errors.New("svg too complex to import") }

out, err := util.SanitizeSVG(svg)
if err != nil && strings.Contains(err.Error(), "too many tokens") {
    // ask user to simplify/optimize the SVG
}

When it happens

Trigger: Calling SanitizeSVG with an SVG containing more than one million XML tokens — megabyte-scale icon files, machine-generated SVGs with per-pixel elements, or a crafted denial-of-service payload with millions of nested/sibling elements.

Common situations: Importing a very large traced/dotted artwork (auto-tracers emit thousands of paths), pasting an exported map/plot with huge element counts, or a malicious upload intended to hang the kernel.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• svg nesting depth exceeds %d
• parse svg failed: %w
• svg contains multiple root elements
• root element is not svg
• svg contains text outside the root element

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/47d68637cd28aef2. Report an issue: GitHub.