Status messages rendered in managed file form elements filter HTML too aggressively

This seems similar in nature to 🐛 Support displaying a message that correctly validates file uploads for the Gin theme. Active . Do they have a common cause?

I believe that the root cause is that Drupal's XSS utility is somewhat dated. There are a pile of "safe" HTML5 tags that are stripped out -- a subset of SVG's elements among them.

This is a somewhat heavy-handed approach that immediately comes to mind to resolve this in the mean-time:

    $status_messages = ['#type' => 'status_messages'];
    
    // Rather than concatenating things in `#prefix`, extract the
    // existing prefix and only run XSS filter on that.
    $prefix = $form['#prefix'] ?? '';
    if (!($prefix instanceof MarkupInterface)) {
      $prefix = Xss::filterAdmin($prefix);
    }
    
    // Then render a build array noting that...
    //  1. $prefix has been sanitized.
    //  2. $status_messages has been sanitized (via Twig)
    $build = [
      ['#markup' => Markup::create($prefix)],
      $status_messages,
      array_filter($form, static fn($key) => $key !== '#prefix', ARRAY_FILTER_USE_KEY),
    ];
    $output = $renderer->renderRoot($build);

This looks related