CVE-2022-24429: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.8
Published: 2022-06-10T20:15Z
Repository: https://github.com/neocotic/convert-svg
Language: Other
Files changed: package.json, packages/convert-svg-core/README.md, packages/convert-svg-core/src/Converter.js, packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg, packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg, packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg, packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg, packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg, packages/convert-svg-to-jpeg/README.md, packages/convert-svg-to-png/README.md, packages/convert-svg-to-webp/README.md
Commit date: 2022-06-06 11:56:36 +0100
Commit message: Remove all disallowed SVG element attributes

In a further attempt to reduce remote code injection attack vectors, all attributes except for a set of allowed standard attributes are removed from the SVG element before being converted. Deprecated attributes are included by default, however, these can also be removed by disabling the new `allowDeprecatedAttributes` option.

Diff: diff --git a/package.json b/package.json
index 4b1ca03..9d23df4 100644
--- a/package.json
+++ b/package.json
@@ -16,10 +16,13 @@
     "install:clean": "npm run clean && npm run install:all",
     "lint": "eslint .",
     "outdated:packages": "lerna exec --stream --no-bail \"npm outdated\"",
     "publish:packages": "lerna publish from-package",
     "test": "mocha -O maxDiffSize=32 -R list \"packages/*/test/**/*.spec.js\"",
+    "test:jpeg": "npm test -- --grep convert-svg-to-jpeg",
+    "test:png": "npm test -- --grep convert-svg-to-png",
+    "test:webp": "npm test -- --grep convert-svg-to-webp",
     "verify": "npm run bootstrap && npm run lint && npm test",
     "version:packages": "lerna version --no-git-tag-version --no-push"
   },
   "engines": {
     "node": "^12.20.0 || >=14"
diff --git a/packages/convert-svg-core/README.md b/packages/convert-svg-core/README.md
index 064f492..2fa108a 100644
--- a/packages/convert-svg-core/README.md
+++ b/packages/convert-svg-core/README.md
@@ -33,17 +33,17 @@ If you're looking to create a converter for a new format, we'd urge you to consi
 that it can be easily integrated and maintained. Read the [Contributors](#contributors) section for information on how
 you can contribute.
 
 ## Implementation
 
-In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new sub-directory for your
+In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new subdirectory for your
 package under the [packages](https://github.com/neocotic/convert-svg/tree/main/packages) directory. Try to follow the
 `convert-svg-to-<FORMAT>` naming convention for the converter package name.
 
-Take a look at the other packages in this directory to setup the new package directory. They are all very similar, by
-design, as the you should just need to provide the minimal amount of information required to support your intended
-output format.
+Take a look at the other packages in this directory to set up the new package directory. They are all very similar, by
+design, as you should just need to provide the minimal amount of information required to support your intended output
+format.
 
 The most important thing that's needed is a implementation of
 [convert-svg-core/src/Provider](https://github.com/neocotic/convert-svg/blob/main/packages/convert-svg-core/src/Provider.js).
 This is an abstract class and contains many methods that *must* be implemented. Read the JSDoc for these methods to
 understand what's needed. If your intended output format requires additional configuration, make the necessary changes
@@ -61,11 +61,11 @@ const { API } = require('convert-svg-core');
 const MyFormatProvider = require('./MyFormatProvider');
 
 module.exports = new API(new MyFormatProvider());
 ```  
 
-Configure this in your `package.json` file and you're API is ready!
+Configure this in your `package.json` file and your API is ready!
 
 ### CLI
 
 Create a file for your CLI (commonly `bin/<PACKAGE-NAME>`) to contain something like the following:
 
@@ -93,11 +93,11 @@ Make sure that your file is executable. For example;
 
 ``` bash
 $ chmod a+x bin/<PACKAGE-NAME>
 ```
 
-Configure this in your `package.json` file and you're CLI is ready!
+Configure this in your `package.json` file and your CLI is ready!
 
 ## Testing
 
 Testing your SVG converter actually works is just as important as implementing it. Since `convert-svg-core` contains a
 lot of the conversion logic, a
diff --git a/packages/convert-svg-core/src/Converter.js b/packages/convert-svg-core/src/Converter.js
index 12653ba..05bd327 100644
--- a/packages/convert-svg-core/src/Converter.js
+++ b/packages/convert-svg-core/src/Converter.js
@@ -33,16 +33,19 @@ const tmp = require('tmp');
 const util = require('util');
 
 const readFile = util.promisify(fs.readFile);
 const writeFile = util.promisify(fs.writeFile);
 
+const _allowedAttributeNames = Symbol('allowedAttributeNames');
+const _allowedDeprecatedAttributeNames = Symbol('allowedDeprecatedAttributeNames');
 const _browser = Symbol('browser');
 const _convert = Symbol('convert');
 const _destroyed = Symbol('destroyed');
 const _getDimensions = Symbol('getDimensions');
 const _getPage = Symbol('getPage');
 const _getTempFile = Symbol('getTempFile');
+const _isAttributeAllowed = Symbol('isAttributeAllowed');
 const _options = Symbol('options');
 const _page = Symbol('page');
 const _parseOptions = Symbol('parseOptions');
 const _provider = Symbol('provider');
 const _roundDimension = Symbol('roundDimension');
@@ -61,12 +64,12 @@ const _validate = Symbol('validate');
  * responsibility of the caller. Due to the fact that creating browser instances is expensive, this level of control
  * allows callers to reuse a browser for multiple conversions. For example; one could create a {@link Converter} and use
  * it to convert a collection of SVG files to files in another format and then destroy it afterwards. It's not
  * recommended to keep an instance around for too long, as it will use up resources.
  *
- * Due constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to. This
- * is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
+ * Due to constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to.
+ * This is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
  * referenced files (e.g. that use the <code>file</code> protocol). This temporary file is reused for the lifespan of
  * each {@link Converter} instance and will be deleted when it is destroyed.
  *
  * It's also the responsibility of the caller to ensure that all {@link Converter} instances are destroyed before the
  * process exits. This is why a short-lived {@link Converter} instance combined with a try/finally block is ideal.
@@ -84,22 +87,86 @@ class Converter {
    * @public
    */
   constructor(provider, options) {
     this[_provider] = provider;
     this[_options] = Object.assign({}, options);
+    this[_allowedAttributeNames] = new Set([
+      // Core
+      'height',
+      'preserveAspectRatio',
+      'viewBox',
+      'width',
+      'x',
+      'xmlns',
+      'y',
+      // Conditional Processing
+      'requiredExtensions',
+      'systemLanguage',
+      // Presentation
+      'clip-path',
+      'clip-rule',
+      'color',
+      'color-interpolation',
+      'cursor',
+      'display',
+      'fill',
+      'fill-opacity',
+      'fill-rule',
+      'filter',
+      'mask',
+      'opacity',
+      'overflow',
+      'pointer-events',
+      'shape-rendering',
+      'stroke',
+      'stroke-dasharray',
+      'stroke-dashoffset',
+      'stroke-linecap',
+      'stroke-linejoin',
+      'stroke-miterlimit',
+      'stroke-opacity',
+      'stroke-width',
+      'style',
+      'transform',
+      'vector-effect',
+      'visibility',
+      // XML
+      'xml:lang',
+      'xmlns',
+      'xmlns:xlink'
+    ]);
+    this[_allowedDeprecatedAttributeNames] = new Set([
+      // Core
+      'baseProfile',
+      'version',
+      'zoomAndPan',
+      // Conditional Processing
+      'requiredFeatures',
+      // Presentation
+      'clip',
+      'color-rendering',
+      'enable-background',
+      // XML
+      'xml:base',
+      'xml:space'
+    ]);
     this[_destroyed] = false;
   }
 
   /**
    * Converts the specified <code>input</code> SVG into another format using the <code>options</code> provided.
    *
-   * <code>input</code> can either be a SVG buffer or string.
+   * <code>input</code> can either be an SVG buffer or string.
    *
    * If the width and/or height cannot be derived from <code>input</code> then they must be provided via their
    * corresponding options. This method attempts to derive the dimensions from <code>input</code> via any
    * <code>width</code>/<code>height</code> attributes or its calculated <code>viewBox</code> attribute.
    *
+   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
+   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
+   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
+   *
    * This method is resolved with the converted output buffer.
    *
    * An error will occur if this {@link Converter} has been destroyed, both the <code>baseFile</code> and
    * <code>baseUrl</code> options have been provided, <code>input</code> does not contain an SVG element, or no
    * <code>width</code> and/or <code>height</code> options were provided and this information could not be derived from
@@ -127,10 +194,14 @@ class Converter {
    *
    * If the width and/or height cannot be derived from the input file then they must be provided via their corresponding
    * options. This method attempts to derive the dimensions from the input file via any
    * <code>width</code>/<code>height</code> attributes or its calculated <code>viewBox</code> attribute.
    *
+   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
+   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
+   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
+   *
    * This method is resolved with the path of the converted output file for reference.
    *
    * An error will occur if this {@link Converter} has been destroyed, both the <code>baseFile</code> and
    * <code>baseUrl</code> options have been provided, the input file does not contain an SVG element, no
    * <code>width</code> and/or <code>height</code> options were provided and this information could not be derived from
@@ -188,11 +259,11 @@ class Converter {
 
   async [_convert](input, options) {
     input = Buffer.isBuffer(input) ? input.toString('utf8') : input;
 
     const { provider } = this;
-    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg')));
+    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg'), options));
 
     if (!svg) {
       throw new Error('SVG element not found in input. Check the SVG input');
     }
 
@@ -319,10 +390,15 @@ html { background-color: ${provider.getBackgroundColor(options)}; }
         }
       });
     });
   }
 
+  [_isAttributeAllowed](attributeName, options) {
+    return this[_allowedAttributeNames].has(attributeName) ||
+      (options.allowDeprecatedAttributes && this[_allowedDeprecatedAttributeNames].has(attributeName));
+  }
+
   [_parseOptions](options, inputFilePath) {
     options = Object.assign({}, options);
 
     const { provider } = this;
 
@@ -332,10 +408,14 @@ html { background-color: ${provider.getBackgroundColor(options)}; }
       const outputFileName = `${path.basename(inputFilePath, path.extname(inputFilePath))}${extension}`;
 
       options.outputFilePath = path.join(outputDirPath, outputFileName);
     }
 
+    if (typeof options.allowDeprecatedAttributes !== 'boolean') {
+      options.allowDeprecatedAttributes = true;
+    }
+
     if (options.baseFile != null && options.baseUrl != null) {
       throw new Error('Both baseFile and baseUrl options specified. Use only one');
     }
     if (typeof options.baseFile === 'string') {
       options.baseUrl = fileUrl(options.baseFile);
@@ -383,12 +463,20 @@ html { background-color: ${provider.getBackgroundColor(options)}; }
       width: this[_roundDimension](dimensions.width, rounding),
       height: this[_roundDimension](dimensions.height, rounding),
     };
   }
 
-  [_sanitize](svg) {
-    return svg.removeAttr('onload');
+  [_sanitize](svg, options) {
+    const attributeNames = Object.keys(svg.attr() || {});
+
+    for (const attributeName of attributeNames) {
+      if (!this[_isAttributeAllowed](attributeName, options)) {
+        svg.removeAttr(attributeName);
+      }
+    }
+
+    return svg;
   }
 
   async [_setDimensions](page, dimensions) {
     if (typeof dimensions.width !== 'number' && typeof dimensions.height !== 'number') {
       return;
@@ -455,10 +543,12 @@ module.exports = Converter;
 
 /**
  * The options that can be passed to {@link Converter#convert}.
  *
  * @typedef {Object} Converter~ConvertOptions
+ * @property {boolean} [allowDeprecatedAttributes=true] - Whether deprecated SVG element attributes should be retained
+ * in the SVG during conversion.
  * @property {string} [background] - The background color to be used to fill transparent regions within the SVG. If
  * omitted, the {@link Provider} will determine the default background color.
  * @property {string} [baseFile] - The path of the file to be converted into a file URL to use for all relative URLs
  * contained within the SVG. Cannot be used in conjunction with the <code>baseUrl</code> option.
  * @property {string} [baseUrl] - The base URL to use for all relative URLs contained within the SVG. Cannot be used in
diff --git a/packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg b/packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg
index f7c9fb4..a47251d 100644
--- a/packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg
+++ b/packages/convert-svg-test-helper/src/fixtures/input/data-url-font.svg
@@ -1,6 +1,6 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewPort="0 0 1000 1000">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewBox="0 0 1000 1000">
     <circle cx="230" cy="230" r="230" fill="#E91E63" />
     <text x="230" y="235" alignment-baseline="central" text-anchor="middle" fill="#fff" font-size="275" font-weight="100" font-family="Roboto">X</text>
     <defs>
         <style type="text/css">
         @font-face {
diff --git a/packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg b/packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg
index b317841..994ed69 100644
--- a/packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg
+++ b/packages/convert-svg-test-helper/src/fixtures/input/viewbox-only-2.svg
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" enable-background="new 0 0 100 99.864" xml:space="preserve">
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" style="enable-background: new 0 0 100 99.864" xml:space="preserve">
   <rect x="0" y="0" width="100" height="100" fill="#808080"/>
   <path fill="#231F20" d="M83.713,63.42c-0.307-1.176-0.998-2.188-1.795-3.023c0.539-2.354,0.832-4.801,0.832-7.314
   C77.318,54.467,77.18,55.815,76.98,57.143"></path>
   <path fill="#231F20" d="M44.366,48.122c0,2.231-1.808,4.039-4.039,4.039s-4.039-1.807-4.039-4.039c0-2.23,1.808-4.039,4.039-4.039
   S44.366,45.892,44.366,48.122"></path>
diff --git a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg
index faa779f..9898bed 100644
--- a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg
+++ b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-2.svg
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Generator: Adobe Illustrator 17.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="100px" height="100px" viewBox="206 206 100 100" enable-background="new 206 206 100 100" xml:space="preserve">
+	 width="100px" height="100px" viewBox="206 206 100 100" style="enable-background: new 206 206 100 100" xml:space="preserve">
 <path id="check-mark-3-icon" d="M256,206c-27.614,0-50,22.386-50,50s22.386,50,50,50s50-22.386,50-50S283.614,206,256,206z
 	 M247.493,282.932l-23.623-23.629l10.058-10.06l13.564,13.568l31.315-31.315l10.063,10.056L247.493,282.932z"/>
 </svg>
diff --git a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg
index c37d0b7..e3d1388 100644
--- a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg
+++ b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox-3.svg
@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-     width="148px" height="35px" viewBox="0.3 0 148 35" enable-background="new 0.3 0 148 35" xml:space="preserve">
+     width="148px" height="35px" viewBox="0.3 0 148 35" style="enable-background: new 0.3 0 148 35" xml:space="preserve">
 <g>
     <g>
         <path fill="#2AB098" d="M25.9,17.7c0-3.3-2.7-6-6-6s-6,2.7-6,6s2.7,6,6,6S25.9,21,25.9,17.7 M20,27.2c-5.3,0-9.6-4.3-9.6-9.6
             S14.7,8,20,8s9.6,4.3,9.6,9.6S25.2,27.2,20,27.2"/>
     </g>
diff --git a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg
index 23840d7..09f0faa 100644
--- a/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg
+++ b/packages/convert-svg-test-helper/src/fixtures/input/width-height-viewbox.svg
@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Generator: Adobe Illustrator 14.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 43363)  -->
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="505px" height="505px" viewBox="0 0 505 505" enable-background="new 0 0 505 505" xml:space="preserve">
+	 width="505px" height="505px" viewBox="0 0 505 505" style="enable-background: new 0 0 505 505" xml:space="preserve">
 <rect y="0.498" fill="#FBDE34" width="504.67" height="504.442"/>
 <g>
 	<path fill="#524739" d="M217.503,388.691v14.757h-16.155v39.766c0,3.729,0.621,6.214,1.864,7.457
 		c1.243,1.242,3.728,1.863,7.456,1.863c1.243,0,2.432-0.051,3.573-0.155c1.138-0.102,2.226-0.257,3.262-0.466V469
 		c-1.864,0.311-3.937,0.517-6.213,0.621c-2.279,0.103-4.505,0.155-6.68,0.155c-3.417,0-6.655-0.232-9.708-0.698
diff --git a/packages/convert-svg-to-jpeg/README.md b/packages/convert-svg-to-jpeg/README.md
index 6c6f6b9..57fed30 100644
--- a/packages/convert-svg-to-jpeg/README.md
+++ b/packages/convert-svg-to-jpeg/README.md
@@ -65,34 +65,39 @@ The CLI can be used in the following ways:
 
 ### `convert(input[, options])`
 
 Converts the specified `input` SVG into a JPEG using the `options` provided via a headless Chromium instance.
 
-`input` can either be a SVG buffer or string.
+`input` can either be an SVG buffer or string.
 
 If the width and/or height cannot be derived from `input` then they must be provided via their corresponding options.
 This method attempts to derive the dimensions from `input` via any `width`/`height` attributes or its calculated
 `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the JPEG output buffer.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, `input` does not contain an SVG
 element or no `width` and/or `height` options were provided and this information could not be derived from `input`.
 
 #### Options
 
-| Option       | Type                   | Default                 | Description                                                                                                                                                      |
-|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
-| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
-| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
-| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
-| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
-| `quality`    | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
-| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
-| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
-| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
+| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
+|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
+| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
+| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
+| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
+| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
+| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
+| `quality`                   | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
+| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
+| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
+| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
 
 The `puppeteer` option is not available when calling this method on a `Converter` instance created using
 `createConverter`.
 
 #### Example
@@ -121,10 +126,14 @@ The output file is derived from `inputFilePath` unless the `outputFilePath` opti
 
 If the width and/or height cannot be derived from the input file then they must be provided via their corresponding
 options. This method attempts to derive the dimensions from the input file via any `width`/`height` attributes or its
 calculated `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the path of the JPEG output file for reference.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, the input file does not contain an
 SVG element, no `width` and/or `height` options were provided and this information could not be derived from input file,
 or a problem arises while reading the input file or writing the output file.
diff --git a/packages/convert-svg-to-jpeg/test/fixtures/expected/20.jpeg b/packages/convert-svg-to-jpeg/test/fixtures/expected/20.jpeg
index ab129a3..27dd2cc 100644
Binary files a/packages/convert-svg-to-jpeg/test/fixtures/expected/20.jpeg and b/packages/convert-svg-to-jpeg/test/fixtures/expected/20.jpeg differ
diff --git a/packages/convert-svg-to-png/README.md b/packages/convert-svg-to-png/README.md
index 649bbff..1fb267e 100644
--- a/packages/convert-svg-to-png/README.md
+++ b/packages/convert-svg-to-png/README.md
@@ -64,33 +64,38 @@ The CLI can be used in the following ways:
 
 ### `convert(input[, options])`
 
 Converts the specified `input` SVG into a PNG using the `options` provided via a headless Chromium instance.
 
-`input` can either be a SVG buffer or string.
+`input` can either be an SVG buffer or string.
 
 If the width and/or height cannot be derived from `input` then they must be provided via their corresponding options.
 This method attempts to derive the dimensions from `input` via any `width`/`height` attributes or its calculated
 `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the PNG output buffer.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, `input` does not contain an SVG
 element or no `width` and/or `height` options were provided and this information could not be derived from `input`.
 
 #### Options
 
-| Option       | Type                   | Default                 | Description                                                                                                                                                      |
-|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
-| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
-| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
-| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
-| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
-| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
-| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
-| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
+| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
+|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
+| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
+| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
+| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
+| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
+| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
+| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
+| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
+| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
 
 The `puppeteer` option is not available when calling this method on a `Converter` instance created using
 `createConverter`.
 
 #### Example
@@ -119,10 +124,14 @@ The output file is derived from `inputFilePath` unless the `outputFilePath` opti
 
 If the width and/or height cannot be derived from the input file then they must be provided via their corresponding
 options. This method attempts to derive the dimensions from the input file via any `width`/`height` attributes or its
 calculated `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the path of the PNG output file for reference.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, the input file does not contain an
 SVG element, no `width` and/or `height` options were provided and this information could not be derived from input file,
 or a problem arises while reading the input file or writing the output file.
diff --git a/packages/convert-svg-to-png/test/fixtures/expected/20.png b/packages/convert-svg-to-png/test/fixtures/expected/20.png
index 28ae6e6..c1e6bb6 100644
Binary files a/packages/convert-svg-to-png/test/fixtures/expected/20.png and b/packages/convert-svg-to-png/test/fixtures/expected/20.png differ
diff --git a/packages/convert-svg-to-webp/README.md b/packages/convert-svg-to-webp/README.md
index 83ed1a6..67cedfd 100644
--- a/packages/convert-svg-to-webp/README.md
+++ b/packages/convert-svg-to-webp/README.md
@@ -64,33 +64,38 @@ The CLI can be used in the following ways:
 
 ### `convert(input[, options])`
 
 Converts the specified `input` SVG into a WEBP using the `options` provided via a headless Chromium instance.
 
-`input` can either be a SVG buffer or string.
+`input` can either be an SVG buffer or string.
 
 If the width and/or height cannot be derived from `input` then they must be provided via their corresponding options.
 This method attempts to derive the dimensions from `input` via any `width`/`height` attributes or its calculated
 `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the WEBP output buffer.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, `input` does not contain an SVG
 element or no `width` and/or `height` options were provided and this information could not be derived from `input`.
 
 #### Options
 
-| Option       | Type                   | Default                 | Description                                                                                                                                                      |
-|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
-| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
-| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
-| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
-| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
-| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
-| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
-| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
+| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
+|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
+| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
+| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
+| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
+| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
+| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
+| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
+| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
+| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
 
 The `puppeteer` option is not available when calling this method on a `Converter` instance created using
 `createConverter`.
 
 #### Example
@@ -119,10 +124,14 @@ The output file is derived from `inputFilePath` unless the `outputFilePath` opti
 
 If the width and/or height cannot be derived from the input file then they must be provided via their corresponding
 options. This method attempts to derive the dimensions from the input file via any `width`/`height` attributes or its
 calculated `viewBox` attribute.
 
+Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
+being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
+primarily for security purposes to ensure that malicious code cannot be injected.
+
 This method is resolved with the path of the WEBP output file for reference.
 
 An error will occur if both the `baseFile` and `baseUrl` options have been provided, the input file does not contain an
 SVG element, no `width` and/or `height` options were provided and this information could not be derived from input file,
 or a problem arises while reading the input file or writing the output file.
diff --git a/packages/convert-svg-to-webp/test/fixtures/expected/20.webp b/packages/convert-svg-to-webp/test/fixtures/expected/20.webp
index 841dd85..077c8de 100644
Binary files a/packages/convert-svg-to-webp/test/fixtures/expected/20.webp and b/packages/convert-svg-to-webp/test/fixtures/expected/20.webp differ

Vulnerable code: In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new sub-directory for your
Take a look at the other packages in this directory to setup the new package directory. They are all very similar, by
design, as the you should just need to provide the minimal amount of information required to support your intended
output format.
Configure this in your `package.json` file and you're API is ready!
Configure this in your `package.json` file and you're CLI is ready!
 * Due constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to. This
 * is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
   * <code>input</code> can either be a SVG buffer or string.
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg')));
  [_sanitize](svg) {
    return svg.removeAttr('onload');
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewPort="0 0 1000 1000">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" enable-background="new 0 0 100 99.864" xml:space="preserve">
	 width="100px" height="100px" viewBox="206 206 100 100" enable-background="new 206 206 100 100" xml:space="preserve">
     width="148px" height="35px" viewBox="0.3 0 148 35" enable-background="new 0.3 0 148 35" xml:space="preserve">
	 width="505px" height="505px" viewBox="0 0 505 505" enable-background="new 0 0 505 505" xml:space="preserve">
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `quality`    | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
`input` can either be a SVG buffer or string.
| Option       | Type                   | Default                 | Description                                                                                                                                                      |
|--------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `background` | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`   | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`    | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`     | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`  | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`   | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`      | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`      | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Fixed code:     "test:jpeg": "npm test -- --grep convert-svg-to-jpeg",
    "test:png": "npm test -- --grep convert-svg-to-png",
    "test:webp": "npm test -- --grep convert-svg-to-webp",
In order to create a new SVG converter that uses `convert-svg-core`, you'll need to create a new subdirectory for your
Take a look at the other packages in this directory to set up the new package directory. They are all very similar, by
design, as you should just need to provide the minimal amount of information required to support your intended output
format.
Configure this in your `package.json` file and your API is ready!
Configure this in your `package.json` file and your CLI is ready!
const _allowedAttributeNames = Symbol('allowedAttributeNames');
const _allowedDeprecatedAttributeNames = Symbol('allowedDeprecatedAttributeNames');
const _isAttributeAllowed = Symbol('isAttributeAllowed');
 * Due to constraints within Chromium, the SVG input is first written to a temporary HTML file and then navigated to.
 * This is because the default page for Chromium is using the <code>chrome</code> protocol so cannot load externally
    this[_allowedAttributeNames] = new Set([
      // Core
      'height',
      'preserveAspectRatio',
      'viewBox',
      'width',
      'x',
      'xmlns',
      'y',
      // Conditional Processing
      'requiredExtensions',
      'systemLanguage',
      // Presentation
      'clip-path',
      'clip-rule',
      'color',
      'color-interpolation',
      'cursor',
      'display',
      'fill',
      'fill-opacity',
      'fill-rule',
      'filter',
      'mask',
      'opacity',
      'overflow',
      'pointer-events',
      'shape-rendering',
      'stroke',
      'stroke-dasharray',
      'stroke-dashoffset',
      'stroke-linecap',
      'stroke-linejoin',
      'stroke-miterlimit',
      'stroke-opacity',
      'stroke-width',
      'style',
      'transform',
      'vector-effect',
      'visibility',
      // XML
      'xml:lang',
      'xmlns',
      'xmlns:xlink'
    ]);
    this[_allowedDeprecatedAttributeNames] = new Set([
      // Core
      'baseProfile',
      'version',
      'zoomAndPan',
      // Conditional Processing
      'requiredFeatures',
      // Presentation
      'clip',
      'color-rendering',
      'enable-background',
      // XML
      'xml:base',
      'xml:space'
    ]);
   * <code>input</code> can either be an SVG buffer or string.
   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
   *
   * Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG
   * before being converted. This includes deprecated attributes unless the <code>allowDeprecatedAttributes</code>
   * option is disabled. This is primarily for security purposes to ensure that malicious code cannot be injected.
   *
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg'), options));
  [_isAttributeAllowed](attributeName, options) {
    return this[_allowedAttributeNames].has(attributeName) ||
      (options.allowDeprecatedAttributes && this[_allowedDeprecatedAttributeNames].has(attributeName));
  }

    if (typeof options.allowDeprecatedAttributes !== 'boolean') {
      options.allowDeprecatedAttributes = true;
    }

  [_sanitize](svg, options) {
    const attributeNames = Object.keys(svg.attr() || {});

    for (const attributeName of attributeNames) {
      if (!this[_isAttributeAllowed](attributeName, options)) {
        svg.removeAttr(attributeName);
      }
    }

    return svg;
 * @property {boolean} [allowDeprecatedAttributes=true] - Whether deprecated SVG element attributes should be retained
 * in the SVG during conversion.
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%" viewBox="0 0 1000 1000">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 100 99.864" style="enable-background: new 0 0 100 99.864" xml:space="preserve">
	 width="100px" height="100px" viewBox="206 206 100 100" style="enable-background: new 206 206 100 100" xml:space="preserve">
     width="148px" height="35px" viewBox="0.3 0 148 35" style="enable-background: new 0.3 0 148 35" xml:space="preserve">
	 width="505px" height="505px" viewBox="0 0 505 505" style="enable-background: new 0 0 505 505" xml:space="preserve">
`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. White will be used if omitted.                                                           |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `quality`                   | Number                 | `100`                   | Quality of the output to be generated.                                                                                                                           |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

`input` can either be an SVG buffer or string.
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.

| Option                      | Type                   | Default                 | Description                                                                                                                                                      |
|-----------------------------|------------------------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `allowDeprecatedAttributes` | Boolean                | `true`                  | Whether deprecated SVG element attributes should be retained in the SVG during conversion.                                                                       |
| `background`                | String                 | N/A                     | Background color to be used to fill transparent regions within the SVG. Will remain transparent if omitted.                                                      |
| `baseFile`                  | String                 | N/A                     | Path of the file to be converted into a file URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseUrl` option. |
| `baseUrl`                   | String                 | `"file:///path/to/cwd"` | Base URL to use for all relative URLs contained within the SVG. Cannot be used in conjunction with the `baseFile` option.                                        |
| `height`                    | Number/String          | N/A                     | Height of the output to be generated. Derived from SVG input if omitted.                                                                                         |
| `puppeteer`                 | Object                 | N/A                     | Options that are to be passed directly to `puppeteer.launch` when creating the `Browser` instance.                                                               |
| `rounding`                  | `ceil`/`floor`/`round` | `"round"`               | Type of rounding to be applied to the width and height.                                                                                                          |
| `scale`                     | Number                 | `1`                     | Scale to be applied to the width and height (specified as options or derived).                                                                                   |
| `width`                     | Number/String          | N/A                     | Width of the output to be generated. Derived from SVG input if omitted.                                                                                          |
Only standard SVG element attributes (excl. event attributes) are allowed and others are stripped from the SVG before
being converted. This includes deprecated attributes unless the `allowDeprecatedAttributes` option is disabled. This is
primarily for security purposes to ensure that malicious code cannot be injected.