Gathering detailed insights and metrics for react-svg
Gathering detailed insights and metrics for react-svg
Gathering detailed insights and metrics for react-svg
Gathering detailed insights and metrics for react-svg
npm install react-svg
Module System
Min. Node Version
Typescript Support
Node Version
NPM Version
839 Stars
3,981 Commits
93 Forks
8 Watching
1 Branches
14 Contributors
Updated on 26 Nov 2024
Minified
Minified + Gzipped
TypeScript (78.66%)
JavaScript (21.34%)
Cumulative downloads
Total Downloads
Last day
-0.2%
36,601
Compared to previous day
Last week
5.4%
186,148
Compared to previous week
Last month
13.1%
776,256
Compared to previous month
Last year
16.3%
8,167,151
Compared to previous year
45
A React component that injects SVG into the DOM.
Background | Basic Usage | Live Examples | API | Installation | FAQ | License
Let's say you have an SVG available at some URL, and you'd like to inject it into the DOM for various reasons. This module does the heavy lifting for you by delegating the process to @tanem/svg-injector, which makes an AJAX request for the SVG and then swaps in the SVG markup inline. The async loaded SVG is also cached, so multiple uses of an SVG only require a single server request.
1import { createRoot } from 'react-dom/client' 2import { ReactSVG } from 'react-svg' 3 4const container = document.getElementById('root') 5const root = createRoot(container) 6root.render(<ReactSVG src="svg.svg" />)
Props
src
- The SVG URL.afterInjection(svg)
- Optional Function to call after the SVG is injected. svg
is the injected SVG DOM element. If an error occurs during execution it will be routed to the onError
callback, and if a fallback
is specified it will be rendered. Defaults to () => {}
.beforeInjection(svg)
- Optional Function to call just before the SVG is injected. svg
is the SVG DOM element which is about to be injected. If an error occurs during execution it will be routed to the onError
callback, and if a fallback
is specified it will be rendered. Defaults to () => {}
.desc
- Optional String used for SVG <desc>
element content. If a <desc>
exists it will be replaced, otherwise a new <desc>
is created. Defaults to ''
, which is a noop.evalScripts
- Optional Run any script blocks found in the SVG. One of 'always'
, 'once'
, or 'never'
. Defaults to 'never'
.fallback
- Optional Fallback to use if an error occurs during injection, or if errors are thrown from the beforeInjection
or afterInjection
functions. Can be a string, class component, or function component. Defaults to null
.httpRequestWithCredentials
- Optional Boolean indicating if cross-site Access-Control requests for the SVG should be made using credentials. Defaults to false
.loading
- Optional Component to use during loading. Can be a string, class component, or function component. Defaults to null
.onError(error)
- Optional Function to call if an error occurs during injection, or if errors are thrown from the beforeInjection
or afterInjection
functions. error
is an unknown
object. Defaults to () => {}
.renumerateIRIElements
- Optional Boolean indicating if SVG IRI addressable elements should be renumerated. Defaults to true
.title
- Optional String used for SVG <title>
element content. If a <title>
exists it will be replaced, otherwise a new <title>
is created. Defaults to ''
, which is a noop.useRequestCache
- Optional Use SVG request cache. Defaults to true
.wrapper
- Optional Wrapper element types. One of 'div'
, 'span'
or 'svg'
. Defaults to 'div'
.Other non-documented properties are applied to the outermost wrapper element.
Example
1<ReactSVG 2 afterInjection={(svg) => { 3 console.log(svg) 4 }} 5 beforeInjection={(svg) => { 6 svg.classList.add('svg-class-name') 7 svg.setAttribute('style', 'width: 200px') 8 }} 9 className="wrapper-class-name" 10 desc="Description" 11 evalScripts="always" 12 fallback={() => <span>Error!</span>} 13 httpRequestWithCredentials={true} 14 loading={() => <span>Loading</span>} 15 onClick={() => { 16 console.log('wrapper onClick') 17 }} 18 onError={(error) => { 19 console.error(error) 20 }} 21 renumerateIRIElements={false} 22 src="svg.svg" 23 title="Title" 24 useRequestCache={false} 25 wrapper="span" 26/>
⚠️This library depends on @tanem/svg-injector, which uses
Array.from()
. If you're targeting browsers that don't support that method, you'll need to ensure an appropriate polyfill is included manually. See this issue comment for further detail.
$ npm install react-svg
There are also UMD builds available via unpkg:
For the non-minified development version, make sure you have already included:
For the minified production version, make sure you have already included:
This module delegates it's core behaviour to @tanem/svg-injector, which requires the presence of a parent node when swapping in the SVG element. The swapping in occurs outside of React flow, so we don't want React updates to conflict with the DOM nodes @tanem/svg-injector
is managing.
Example output, assuming a div
wrapper:
1<div> <!-- The wrapper, managed by React --> 2 <div> <!-- The parent node, managed by @tanem/svg-injector --> 3 <svg>...</svg> <!-- The swapped-in SVG, managed by @tanem/svg-injector --> 4 </div> 5</div>
See:
Related issues and PRs:
MIT
The latest stable version of the package.
Stable Version
1
0/10
Summary
Cross-Site Scripting in react-svg
Affected Versions
< 2.2.18
Patched Versions
2.2.18
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
Reason
Found 0/5 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Reason
22 existing vulnerabilities detected
Details
Score
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More