v0.6.0 fails to convert mermaid SVGs properly

[aloisklink]

Version 0.6.0 of convert-svg introduced a fix for CVE-2021-23631. Unfortunately, this fix also breaks some mermaid SVGs.

I don't expect this to be fixed (I'm guessing the mermaid SVGs have some insecure content), but maybe it's worth adding a CLI option like --unsafe-rendering that prints a warning like: WARNING: Unsafe SVG rendering. Do not use on untrusted SVGs.

Example input SVG:

After running: npx [email protected] flowchart1.svg

After running npx [email protected] flowchart1.svg (or v0.6.4)

Interestingly, if I right-click the above SVG and press "Open Image in new Tab", I get the same black boxes and an error:

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-/C0W1MmEdSZ8Qc3zqXhUQUNNeN8XEY/0XTJGaU0Iwws='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.