Cloudflare went down this road a bit:

https://github.com/cloudflare/svg-hush