A C0 control character in a node or community label (an ANSI escape from a
pasted terminal capture, a form feed used as a section separator) made
`graphify export svg` write a graph.svg that is not well-formed XML, while
the command still reported success. #2897 fixed the same hazard for GraphML
and Obsidian and left to_svg out: for a label without a pair of `$` it does
not abort, matplotlib only warns about a missing glyph.
matplotlib's SVG backend copies each drawn string into a comment
(`<!-- text -->`, the default svg.fonttype) and escapes `&`, `<`, `>` and
`--`, but not control characters, so xmllint and Python's expat reject the
file.
Pass the node labels and the legend text through _strip_xml_illegal, the
helper to_graphml already uses: tab, LF and CR stay, the other C0 controls
are dropped. A non-string label is str()-ed first, as networkx already did.
Not covered here: the id a node without a label is drawn under (the next
commit), and U+FFFE and U+FFFF, which the helper does not match either.
Assisted-by: assayer harness on Claude Code (https://github.com/Yyunozor/assayer-memory-mcp)
Yyunozor
697c9338b2