6007 2005-12-08 04:01:20 -0800 WebKit+SVG should have common code to validate uri references 2026-10-19 12:19:27 -0700 1 1 1 Unclassified WebKit SVG 420+ Mac OS X 10.4 NEW https://bugs.webkit.org/show_bug.cgi?id=328066 http://www.w3.org/TR/SVG11/struct.html#Head P4 Normal --- 91791 1 eric rwlbuis ahmad.saleem792 annevk cigitia ian karlcow oldest_to_newest 25712 0 eric 2005-12-08 04:01:20 -0800 WebKit+SVG should have common code to validate uri references The SVG spec defines exactly what sort of elements can reference other elements in the SVG spec. Although we do some checking, we don't have a nice consistant model. I think finding a nice way to implement this (with a virtual function on SVGElement?) could be a win for both code clarity and spec conformance. For a list of which elements are allowed to map to which others: http://www.w3.org/TR/SVG11/struct.html#Head 2166437 1 karlcow 2025-12-16 15:42:41 -0800 16.1.5. URL reference attributes https://svgwg.org/svg2-draft/linking.html#linkRefAttrs URL references are normally specified with an ‘href’ attribute. The value of this attribute forms a reference for the desired resource (or secondary resource, if there is a fragment identifier). The value of the ‘href’ attribute must be a URL. Because it is impractical for any application to check that a value is an URL reference, this specification follows the lead of the URL Specification in this matter and imposes no such conformance testing requirement on SVG authoring tools. An invalid URL does not make an SVG document non-conforming. SVG user agents are only required to process URLs when needed, as specified in Processing of URL references. and https://svgwg.org/svg2-draft/linking.html#processingURL A lot of the code in https://searchfox.org/wubkat/source/Source/WebCore/svg/SVGURIReference.cpp 2166478 2 ahmad.saleem792 2025-12-16 17:48:01 -0800 Some WPT Tests as well - https://wpt.fyi/results/svg?label=master&label=experimental&aligned&q=url- 2266176 3 karlcow 2026-10-19 12:19:27 -0700 SVG 2 describes one pipeline for URL references: https://w3c.github.io/svgwg/svg2-draft/linking.html#processingURL 1. generate the absolute URL, 2. fetch the document if needed, 3. identify the target element, 4. then check it is a valid target. WebKit has no single implementation of it. What exists today: - SVG href attributes: SVGURIReference::targetElementFromIRIString() finds the element, then each caller checks the type (gradients, pattern, mpath, textPath, use). - CSS references (clip-path, mask, filter, marker-*, fill, stroke): ReferencedSVGResources::referencedSVGResourceIDs() already holds one table of allowed element types. The id comes from Style::URL::fragment(). - The fragment extraction and the same-document test are also written separately for HTML: Element::findAnchorElementForLink(), LocalFrameView::scrollToFragment(), HTMLLinkElement (rel=expect). They differ in whether the fragment is percent-decoded and in which URL they compare with (document URL or base URL). Differences found so far: - percent-encoded ids: clip-path and filter did not decode, the other references did. Bug 328066. - textPath to a basic shape does not follow later changes to the shape. Bug 328044. Blink accepts only a path there. - mpath to a shape element: allowed by SVG Animations 2, not by WebKit or Blink. Bug 317648 and Bug 325582. - use: all three engines are stricter than the SVG 2 table, in different ways. Bug 301280 covers foreignObject. Not looked at yet: * the effect of a base element, xml:base, * data: URLs (there is a FIXME in targetElementFromIRIString), * the fetch rules (CORS state, secure static mode, SMIL external hrefs), * and when a reference is re-resolved after the attribute changes. One helper function could do the common part: 1. take a URL, 2. say whether it points at the current document, 3. and return the id with percent escapes decoded. The SVG attribute path, scroll-to-fragment and rel=expect could all call it. Not proposing it here. The differences above are being fixed one by one, and a helper can be considered once they are in. Or we could close this bug and decides to treat all of this separately. I'm updating the URL reference too from SVG 1.1 to SVG 2.0 https://w3c.github.io/svgwg/svg2-draft/struct.html#Head