If you want to integrate SVG scanning into a bigger application, you should use detect-svg-scripts directly instead. This package only contains a CLI tool for it.
Licensed under either the WTFPL or CC0, at your choice. In practice, that means it's more or less public domain, and you can do whatever you want with it. Giving credit is not required, but still very much appreciated! I'd love to hear from you if this module was useful to you.
Creating and maintaining open-source modules is a lot of work. A donation is also not required, but much appreciated! You can donate here.
scriptless-svg on the Web Platform Tests for SVG:
scriptless-svg takes any amount of paths and/or globs as its arguments. If an argument doesn't exist as an exact path, it is assumed to be a glob (and will fail if not). You can include negated globs to exclude certain patterns.
Additionally, you can pass the
--errors-only flag to omit all files from the output that passed the check successfully. This is especially recommended for CI setups where you are only interested in the failures.
Note that by default, only files that end in
.svg are considered when you specify a directory path. If you wish to also scan files with a different extension, it must be an explicit glob.
The process will return exit code 1 if any scanned files failed the check (ie. contain scripts), or exit code 0 if all files passed.
*.svg files in the current directory and any subdirectories:
*.svg files in a given target directory and its subdirectories:
Complex globs, with eg. exclusions (note that globs should be single-quoted to work correctly!):
scriptless-svg svg/ '!svg/scriptable/**/*.scriptable.svg'
Show only the files that failed the check (ie. contain scripts), not the ones that passed:
scriptless-svg --errors-only svg/