SVG Sanitizer features added

[VikassWebkul214254]

Issue Reference

https://gist.github.com/shellkraft/a8b1f35d5c3ba313605065889563fb00?permalink_comment_id=5524476#gistcomment-5524476

Description

SVG Sanitizer

How To Test This?

https://gist.github.com/shellkraft/a8b1f35d5c3ba313605065889563fb00?permalink_comment_id=5524476#gistcomment-5524476

Please follow the all process which is mentioned in video.

[Copilot]

Copilot reviewed 1 out of 5 changed files in this pull request and generated no comments.

Files not reviewed (4)

• composer.json: Language not supported
• packages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php: Language not supported
• packages/Webkul/Admin/src/Resources/views/components/form/control-group/control.blade.php: Language not supported
• packages/Webkul/Core/src/Traits/Sanitizer.php: Language not supported

[sagarkumar-webkul]

The SVG sanitiser feature has been implemented; however, a UI issue occurs during SVG image upload that needs to be addressed. Additionally, the password does not change after following the provided testing steps.
-https://webkul.chatwhizz.com/share/view-recording/681217cb3112bb06ef375177

[VikassWebkul214254]

The SVG sanitiser feature has been implemented; however, a UI issue occurs during SVG image upload that needs to be addressed. Additionally, the password does not change after following the provided testing steps. -https://webkul.chatwhizz.com/share/view-recording/681217cb3112bb06ef375177

File broken issue is not found in my instance. you need to verify it again.

[sagarkumar-webkul]

I have retested the issue—currently, the image is not visible after uploading. -----https://webkul.chatwhizz.com/share/view-recording/681456edc4a93f076923eab3

[sagarkumar-webkul]

I've tested this issue further and found that while the SVG file is no longer capable of changing admin credentials, it can still trigger an alert() message when opened in a new browser tab.
This indicates that the SVG content is not fully sanitized — embedded JavaScript inside the SVG is still being executed. Although the direct credential change is blocked, this could still be a vector for XSS attacks or social engineering if not handled properly.
video link1- https://webkul.chatwhizz.com/share/view-recording/681dc4d627c29f37d004d16c
video link2- https://webkul.chatwhizz.com/share/view-recording/681dc8ab27c29f37d004d2c1

[sagarkumar-webkul]

Verified: The SVG file has been sanitized to remove embedded scripts for security compliance. As a result, any interactive features (such as JavaScript-based functionality) within the SVG no longer work when opened directly in a new tab.
-https://webkul.chatwhizz.com/share/view-recording/681de3de27c29f37d004dc6b