Clarification: 1.3.4 “Draw graphics”

1.3.4 Verify that user‑supplied Scalable Vector Graphics (SVG) scriptable content is
validated or sanitized to contain only tags and attributes (such as draw
graphics) that are safe for the application, e.g., do not contain scripts and
foreignObject.

• “Draw graphics” is not a technical term. A clearer phrase would be something like “static visual rendering elements such as <rect>, <circle>, <line>, <path>.”
• The requirement doesn’t explain when validation should happen, whether at upload time, render time, or both.
• It doesn’t mention any recommended tools or libraries. I think It should also recommend using established, actively maintained SVG sanitization libraries with a strong security track record.
• "Validated or sanitize" this confuse the developer, It should emphasize strict allowlisting of SVG tags and attributes, never depend on general-purpose sanitization for SVG.

Read the raw Markdown requirements in the 5.0 branch, locate requirement 1.3.4, and review the issue's proposed wording changes. Compare the surrounding ASVS requirements for terminology and scope. Done means the requirement clearly defines safe SVG content and the expected validation or sanitization guidance, with the discussion resolved in the issue.