
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
svg-url-loader
Advanced tools
A webpack loader which loads SVG file as utf-8 encoded DataUrl string.
Existing url-loader always does Base64 encoding for data-uri. As SVG content is a human-readable xml string, using base64 encoding is not mandatory. Instead, one may only escape unsafe characters and replace " with ' as described in this article.
There are some benefits for choosing utf-8 encoding over base64.
Parameters can be passed both in an url or from webpack config file. See Loaders section in webpack documentation for more details.
Passing parameters using resourceQuery is also supported:
.selector {
background-image: url(../assets/foo.svg?encoding=base64);
}
The loader supports the following parameters:
limitIf given, loader will not encode the source file if its content is greater than this limit.
Defaults to no limit.
If the file is greater than the limit the file-loader is used, receiving all query parameters set for svg-url-loader.
require("svg-url-loader?limit=1024!./file.svg");
// => DataUrl if "file.png" is smaller that 1kb
require("svg-url-loader?prefix=img/!./file.svg");
// => Parameters for the file-loader are valid too
// They are passed to the file-loader if used.
stripdeclarationsThis option is true by default. It will be removed in the next major release.
See this issue for more context about this decision.
If given will tell the loader to strip out any XML declaration, e.g. <?xml version="1.0" encoding="UTF-8"?> at the beginning of imported SVGs.
Internet Explorer (tested in Edge 14) cannot handle XML declarations in CSS data URLs (content: url("data:image/svg...")).
require("svg-url-loader?stripdeclarations!./file.svg");
iesafeThis option tells loader to fall back to the file-loader if the file contains a style-element and the encoded size is above 4kB no matter the limit specified.
This option was introduced because Internet Explorer (including IE11) stops parsing style-elements in SVG data-URIs longer than 4kB. This results in black fill-color for all styled shapes.
You can either specify iesafe option in the query:
// apply `iesafe` option only for 'foo.svg'
require("svg-url-loader?iesafe!./foo.svg");
Or, you can set this option globally in you webpack config:
module.exports = {
//...
module: {
rules: [
{
test: /\.svg/,
use: {
loader: "svg-url-loader",
options: {
// make all svg images to work in IE
iesafe: true,
},
},
},
],
},
//...
};
encodingThis option controls which encoding to use when constructing a data-URI for an SVG. When set to a non-"none" value, loader does not apply quotes to the resulting data-URI.
Possible values are "base64" and "none". Defaults to "none".
Normally, setting encoding option to base64 should not be required, as using base64 encoding defeats the original purpose of this loader - embed svg with minimal size overhead. However, because of incompatibility with some tools, we support this mode, too.
You can either specify base64 option in the query:
// apply `base64` option only for 'foo.svg'
require("svg-url-loader?encoding=base64!./foo.svg");
Or, you can set this option globally in you webpack config:
module.exports = {
//...
module: {
rules: [
{
test: /\.svg/,
use: {
loader: "svg-url-loader",
options: {
// make loader to behave like url-loader, for all svg files
encoding: "base64",
},
},
},
],
},
//...
};
require("svg-url-loader!./file.svg");
// => DataUrl for file.svg
.icon {
background: url("../images/file.svg");
}
module.exports = {
//...
module: {
rules: [
{
test: /\.svg/,
use: {
loader: "svg-url-loader",
options: {},
},
},
],
},
//...
};
The url-loader package is a webpack loader that can inline files as data URLs. It supports various file types, including images, fonts, and SVGs. Compared to svg-url-loader, url-loader is more versatile as it can handle multiple file types, but it may require additional configuration for SVG-specific optimizations.
The file-loader package is another webpack loader that handles file imports. Unlike svg-url-loader, file-loader does not inline files as URLs but instead copies them to the output directory and returns the URL to the file. This can be useful for larger files or when you do not want to inline the content.
The svg-inline-loader package is a webpack loader that inlines SVGs directly into the HTML or JavaScript as inline SVG elements. This is different from svg-url-loader, which inlines SVGs as URLs. svg-inline-loader can be useful when you need to manipulate the SVG elements directly in the DOM.
FAQs
Converts SVG file to utf-8 encoded data-uri string
The npm package svg-url-loader receives a total of 252,263 weekly downloads. As such, svg-url-loader popularity was classified as popular.
We found that svg-url-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.