phpdftk/svg

Pure-PHP SVG 2 parser. Produces a typed tree (SvgDocument, Group, Path, Text\TextElement, Text\Tspan, Shape\Rect, Shape\Circle, Shape\Ellipse, Shape\Line, Shape\Polyline, Shape\Polygon, GenericElement, …) with on-demand attribute parsing, including the transform attribute (Value\Transform), the d path-data grammar (Path\PathData), SVG 2 §13 presentation-attribute / paint accessors (fill(), stroke(), Value\Paint, Value\Color), and the SVG 2 §11.6 text positioning + CSS Fonts 4 font accessors.

composer require phpdftk/svg

Quick example

use Phpdftk\Svg\Parser;
use Phpdftk\Svg\Shape\Rect;

$doc = (new Parser())->parse(<<<'SVG'
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="100">
  <rect x="10" y="20" width="30" height="40"/>
</svg>
SVG);

$doc->widthAttribute();   // "200"
$doc->viewBox();          // null (none declared)

foreach ($doc->findByTag('rect') as $r) {
    // $r is a Phpdftk\Svg\Shape\Rect
    $r->x(); $r->y(); $r->width(); $r->height();
}

Security

The parser uses DOMDocument::loadXML with LIBXML_NONET and explicitly leaves LIBXML_NOENT off:

• External entities (<!ENTITY x SYSTEM "file://…"> or http://…) are NOT substituted. Classic XXE payloads return empty content rather than leaking file or network data.
• No network access during parse (no DTD or entity fetches).
• XInclude directives pass through as generic elements; the parser never calls DOMDocument::xinclude().

A SecurityTest suite covers these properties — regressions break CI before they ship.

Status

The parser is feature-complete for the v1 element set: secure XML loader, SvgDocument (with findById id→element index), Group, all five basic shapes, the transform attribute (Value\Transform), <path> with the full SVG 2 §9.3.9 d-grammar, SVG 2 §13 presentation / paint accessors, <text>/<tspan> + CSS Fonts 4 font accessors, <defs>/<symbol>/<use> with intra-document href resolution, <clipPath>/<mask>/<image>, gradients with cycle-safe href chaining, and the optional Css\CssBridge for <style> + presentation-attribute cascade resolution (requires phpdftk/css).

The translator that emits PDF from the parsed tree ships as phpdftk/svg-to-pdf — currently at 95.40% in-scope WPT pass on the SVG corpus.