react-svg

A React component that injects SVG into the DOM.

When To Use This | Basic Usage | API | Live Examples | Installation | Security | FAQ | Contributing | License

When To Use This

This component uses @tanem/svg-injector to fetch an SVG from a given URL and inject its markup into the DOM (why?). Fetched SVGs are cached, so multiple uses of the same SVG only require a single request.

Injection costs a network request and two wrapper elements, and it earns that cost in one case: the SVG's URL isn't known until the app runs, and the markup has to be reachable by CSS. An <img> tag renders an SVG but its contents can't be styled, animated or scripted from the page.

• SVGs live in your repo and are known at build time. Reach for a build-time transform - SVGR, vite-plugin-svgr, or your bundler's SVG loader. They compile each file to a React component, so there's no runtime fetch, and unused icons are tree-shaken out.
• The URL is only known at runtime. SVGs from a CMS or an API, user uploads, a CDN-hosted icon set, or a path assembled from data. That's what this component is for.
• You only need to display the image. Use <img src="https://raw.githubusercontent.com/tanem/react-svg/HEAD/icon.svg">. It's cheaper than either option above.

Basic Usage

import { ReactSVG } from 'react-svg'

const App = () => <ReactSVG src="svg.svg" />

API

Props

Errors thrown from beforeInjection and afterInjection are routed to onError and render the fallback, the same as an error raised by the injection itself.

src

The SVG URL. Supports fetchable URLs (relative or absolute), data:image/svg+xml URLs (URL-encoded or base64), and SVG sprite sheets via fragment identifiers (e.g. sprite.svg#icon-star). See the data URL example and sprite usage example.

afterInjection

Called after the SVG is injected. svg is the injected SVG DOM element.

beforeInjection

Called just before the SVG is injected. svg is the SVG DOM element which is about to be injected, so this is where to restyle, class or sanitise it - see Security.

desc

String used for the SVG <desc> element content. If a <desc> exists it is replaced, otherwise a new one is created. When set, a unique id is added to the <desc> element and aria-describedby is set on the SVG for assistive technology. An empty string is a noop.

evalScripts

Whether to run script blocks found in the SVG: 'always', 'once' or 'never'. Leave it at 'never' for SVGs you don't control - see Security.

fallback

Rendered inside the wrapper if an error occurs. Can be a string, class component or function component. Nothing is rendered in its place when unset.

httpRequestWithCredentials

Whether cross-site Access-Control requests for the SVG are made using credentials.

loading

Rendered inside the wrapper until the SVG is injected. Can be a string, class component or function component. Nothing is rendered in its place when unset.

loadingDelay

Milliseconds to wait before rendering loading. At the default 0 it renders immediately. Set a value and an injection that finishes sooner - a warm request cache, a localhost or file:// read, a warm CDN edge - never renders loading at all.

Use it when loading is a spinner, where a sub-second appearance is worse than none: the user can't tell what flashed. Leave it at 0 when loading is a skeleton sized to hold the SVG's space, because delaying that trades one layout shift for two.

200-300ms is the usual industry choice. The delay applies to loading only - fallback always renders as soon as the error arrives, since an error costs a round trip that no cache short-circuits.

onError

Called if an error occurs. error is an unknown value.

renumerateIRIElements

Whether SVG IRI addressable elements are renumerated. When enabled, IDs on IRI-addressable elements (clipPath, linearGradient, mask, path, etc.) are made unique, and all references to them (presentation attributes, href/xlink:href, inline style attributes, and <style> element text) are updated. All matching element types are renumerated, not only those inside <defs>. Set to false if you need to query injected elements by their original IDs.

title

String used for the SVG <title> element content. If a <title> exists it is replaced, otherwise a new one is created. When set, a unique id is added to the <title> element and aria-labelledby is set on the SVG for assistive technology. An empty string is a noop.

useRequestCache

Whether the SVG request cache is used. With it on, repeated uses of the same URL share a single request.

wrapper

The element type used for the wrappers: 'div', 'span' or 'svg'.

Other props

Props not listed above are applied to the outermost wrapper element, so className, style, id, data-* attributes and DOM event handlers behave as they would on the underlying element.

Ref forwarding

A ref is forwarded to the outermost wrapper element, so ref.current is an HTMLDivElement, HTMLSpanElement or SVGSVGElement depending on wrapper. The exported WrapperType type covers all three.

Re-injection

Re-injection happens when src, wrapper, title, desc, evalScripts, httpRequestWithCredentials, renumerateIRIElements or useRequestCache changes. Other props don't affect the injected SVG, so changing them re-renders the wrapper without re-fetching. afterInjection, beforeInjection and onError are always called in their latest form, but changing them doesn't trigger a re-injection on its own, so they can be passed inline.

Example

<ReactSVG
  beforeInjection={(svg) => {
    svg.classList.add('svg-class-name')
    svg.setAttribute('style', 'width: 200px')
  }}
  className="wrapper-class-name"
  desc="Description"
  fallback={() => <span>Error!</span>}
  loading={() => <span>Loading</span>}
  onClick={() => {
    console.log('wrapper onClick')
  }}
  onError={(error) => {
    console.error(error)
  }}
  src="svg.svg"
  title="Title"
  wrapper="span"
/>

Live Examples

Each name links to the example source, and the sandbox column opens it on CodeSandbox.

Installation

$ npm install react-svg

Requires React 16.8 or later, as a peer dependency.

Security

Injected markup becomes part of your page, with the same privileges as anything else in it. That matters whenever src points at something you don't fully control - user uploads, a third-party host, a CMS anyone can write to. An SVG is an XML document that can carry scripts, event handlers and styles, not just shapes.

Scripts are off by default. evalScripts defaults to 'never', so <script> blocks inside a fetched SVG are not executed. Leave it that way for anything untrusted - 'always' and 'once' run whatever the file happens to contain.

Scripts aren't the only vector. Event-handler attributes such as onload and onclick, and href="javascript:..." on <a> elements, are inert to evalScripts but live once injected. For untrusted sources, sanitise the SVG element in beforeInjection, which runs after the fetch and before the element reaches the DOM:

import DOMPurify from 'dompurify'
import { ReactSVG } from 'react-svg'

const Icon = ({ src }) => (
  <ReactSVG
    beforeInjection={(svg) => {
      DOMPurify.sanitize(svg, { IN_PLACE: true })
    }}
    src={src}
  />
)

Sanitising the URL matters too. A javascript: or data:text/html value in src should never reach this component; validate the URL's scheme and origin before passing it in.

Injected content isn't isolated. A <style> element inside an SVG applies to the whole page, so a fetched file can restyle your app through a generic class name like .cls-1, and the last SVG injected wins (#2077). DOMPurify keeps <style> elements, so sanitising doesn't address this. Remove or rewrite them in beforeInjection if the SVGs aren't yours. Note that renumerateIRIElements (on by default) makes id attributes unique, but does nothing for class names.

FAQ

<div>
  <!-- The wrapper, managed by React -->
  <div>
    <!-- The parent node, managed by @tanem/svg-injector -->
    <svg>...</svg>
    <!-- The swapped-in SVG, managed by @tanem/svg-injector -->
  </div>
</div>

Contributing

Issues and pull requests are welcome. npm run test:src is the development loop; npm test runs the full gate.

Repo conventions that aren't visible in the code - the PR labels that drive releases, the React version matrix policy, and how the examples/ dependencies are pinned - live in AGENTS.md. Coding agents read it from the repo root, so keep it in sync when a change invalidates something it states.

License

MIT