Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

@@ -12,6 +12,7 @@
         "ext-json": "*",
         "ajthinking/archetype": "^1.0.3",
         "composer/composer": "^1.10.22 || ^2.2.12",
+        "enshrined/svg-sanitize": "^0.16.0",
         "facade/ignition-contracts": "^1.0",
         "guzzlehttp/guzzle": "^6.3 || ^7.0",
         "james-heinrich/getid3": "^1.9.21",

@@ -2,6 +2,9 @@
 
 namespace Statamic\Tags;
 
+use enshrined\svgSanitize\data\AllowedAttributes;
+use enshrined\svgSanitize\data\AllowedTags;
+use enshrined\svgSanitize\Sanitizer;
 use Statamic\Facades\File;
 use Statamic\Facades\URL;
 use Statamic\Support\Str;
@@ -47,11 +50,13 @@ public function index()
             $svg = $this->setTitleAndDesc($svg);
         }
 
-        return str_replace(
+        $svg = str_replace(
             '<svg',
             collect(['<svg', $attributes])->filter()->implode(' '),
             $svg
         );
+
+        return $this->sanitize($svg);
     }
 
     private function setTitleAndDesc($svg)
@@ -79,4 +84,58 @@ private function setTitleAndDesc($svg)
 
         return $doc->saveHTML();
     }
+
+    private function sanitize($svg)
+    {
+        if ($this->params->bool('sanitize') === false) {
+            return $svg;
+        }
+
+        $sanitizer = new Sanitizer;
+        $sanitizer->removeXMLTag(! Str::startsWith($svg, '<?xml'));
+        $sanitizer->setAllowedAttrs($this->getAllowedAttrs());
+        $sanitizer->setAllowedTags($this->getAllowedTags());
+
+        return $sanitizer->sanitize($svg);
+    }
+
+    private function getAllowedAttrs()
+    {
+        $attrs = $this->params->explode('allow_attrs', []);
+
+        return new class($attrs) extends AllowedAttributes
+        {
+            private static $attrs = [];
+
+            public function __construct($attrs)
+            {
+                self::$attrs = $attrs;
+            }
+
+            public static function getAttributes()
+            {
+                return array_merge(parent::getAttributes(), self::$attrs);
+            }
+        };
+    }
+
+    private function getAllowedTags()
+    {
+        $tags = $this->params->explode('allow_tags', []);
+
+        return new class($tags) extends AllowedTags
+        {
+            private static $tags = [];
+
+            public function __construct($tags)
+            {
+                self::$tags = $tags;
+            }
+
+            public static function getTags()
+            {
+                return array_merge(parent::getTags(), self::$tags);
+            }
+        };
+    }
 }

@@ -4,6 +4,7 @@
 
 use Illuminate\Support\Facades\File;
 use Statamic\Facades\Parse;
+use Statamic\View\Antlers\Language\Utilities\StringUtilities;
 use Tests\TestCase;
 
 class SvgTagTest extends TestCase
@@ -17,7 +18,10 @@ public function setUp(): void
 
     private function tag($tag)
     {
-        return Parse::template($tag, []);
+        $output = Parse::template($tag, []);
+
+        // Normalize whitespace and line breaks for testing ease.
+        return trim(StringUtilities::normalizeLineEndings($output));
     }
 
     /** @test */
@@ -32,4 +36,70 @@ public function it_renders_svg_with_additional_params()
     {
         $this->assertStringStartsWith('<svg class="mb-2" xmlns="', $this->tag('{{ svg src="users" class="mb-2" }}'));
     }
+
+    /** @test */
+    public function it_sanitizes()
+    {
+        File::put(resource_path('xss.svg'), <<<'SVG'
+<svg>
+    <path onload="loadxss" onclick="clickxss"></path>
+    <script>alert("xss")</script>
+    <foreignObject></foreignObject>
+    <mesh></mesh>
+</svg>
+SVG);
+
+        $this->assertEquals(<<<'SVG'
+<svg>
+  <path></path>
+</svg>
+SVG,
+            $this->tag('{{ svg src="xss" sanitize="true" }}')
+        );
+
+        $this->assertEquals(<<<'SVG'
+<svg>
+  <path onclick="clickxss"></path>
+  <foreignObject></foreignObject>
+  <mesh></mesh>
+</svg>
+SVG,
+            $this->tag('{{ svg src="xss" sanitize="true" allow_tags="mesh|foreignObject" allow_attrs="onclick" }}')
+        );
+    }
+
+    /** @test */
+    public function sanitizing_doesnt_add_xml_tag()
+    {
+        // Thes sanitizer package adds an xml tag by default.
+        // We want to make sure if there wasn't one to begin with, it doesn't add one.
+
+        $svg = <<<'SVG'
+<svg>
+  <path></path>
+</svg>
+SVG;
+
+        File::put(resource_path('xmltag.svg'), $svg);
+
+        $this->assertEquals($svg, $this->tag('{{ svg src="xmltag" sanitize="true" }}'));
+    }
+
+    /** @test */
+    public function sanitizing_doesnt_remove_an_xml_tag()
+    {
+        // Thes sanitizer package adds an xml tag by default.
+        // We want to make sure that we haven't configured it to remove it if we wanted it there to begin with.
+
+        $svg = <<<'SVG'
+<?xml version="1.0" encoding="UTF-8"?>
+<svg>
+  <path></path>
+</svg>
+SVG;
+
+        File::put(resource_path('xmltag.svg'), $svg);
+
+        $this->assertEquals($svg, $this->tag('{{ svg src="xmltag" sanitize="true" }}'));
+    }
 }