[GH-ISSUE #6561] [Bug] Prefixed XHTML forms resolve empty actions against the document base #3949

New issue

Closed

opened 2026-10-31 00:45:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:31 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6561

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

A production-boundary reproduction with rea-agents 6.7.0 and a real Chromium DOMSnapshot returned the document's /assets/ base URL for an empty action on an XHTML h:form and an empty formaction on h:button. Chromium's native action and formAction properties both returned the current document URL. The identical document using unprefixed XHTML elements produced the correct REA destinations.

Reproduction

Serve the following document at /root/prefixed.xhtml with Content-Type: application/xhtml+xml; the fixture server and browser were disposable.

<h:html xmlns:h="http://www.w3.org/1999/xhtml"><h:head><h:base href="/assets/"/></h:head><h:body><h:form id="form" action=""><h:button id="button" formaction="">Go</h:button></h:form></h:body></h:html>

In headless Chromium, load the document, call DOMSnapshot.captureSnapshot with computedStyles: [], and pass the actual snapshot to REA's shipped captureDom with an inspectWebPageInputSchema-parsed input whose allowed_origins contains the fixture origin.
Compare captureDom's action and formaction URL rows with document.getElementById('form').action and document.getElementById('button').formAction. Both REA rows end in /assets/; both native properties end in /root/prefixed.xhtml. One focused run of this fixture and its control showed this difference.
As the control, remove the h: prefixes and put xmlns="http://www.w3.org/1999/xhtml" on html. REA and Chromium then both return /root/control.xhtml for the equivalent control document.

The public affected entry point is inspect_web_page on this HTTP-served document with its origin allowed. A full CLI/MCP request was not run; execution covered the real browser snapshot and the production projection boundary.

Expected behavior

Empty actions on elements in the XHTML namespace should retain the current-document rule regardless of their namespace prefix. The native Chromium properties establish the expected destinations for this fixture, and REA already implements the rule for the unprefixed names in domMetadata.

Impact and scope

Form-navigation evidence is wrong for prefixed XHTML forms or submit controls when a base URL differs from the document URL. The fixture demonstrates both affected attributes and an unprefixed control; population frequency and other XML element variants were not measured. No target files or real browser profiles were modified.

REA version

Observed with npm rea-agents 6.7.0, tag rea-agents-6.7.0 at 27dc42d102. Current main 6bb4f4bf7d has identical CdpCaptureDocuments.ts and CdpCaptureDomSvg.ts source. Current-main runtime scope is source-derived, not executed.

Runtime and platform

Node.js v26.12.1; Linux x86_64; Chromium 155.0.8059.84; headless Playwright connection to a disposable browser.

Target and artifact context

An HTTP-served application/xhtml+xml document with XHTML namespace-prefixed form and button elements and a same-origin base href.

Interface

Other

Earliest failure stage

Capture or observation

Relevant output or evidence

Expected source: Native Chromium action and formAction properties both returned the fixture document URL; the unprefixed control agreed with REA.
Failure source: REA captureDom returned action and formaction rows pointing to the /assets/ base URL for the prefixed fixture.
Evidence provenance: observed production-boundary output on 6.7.0, with source-derived current-main reachability.
Local verification: reproduced at the production projection boundary; full CLI/MCP execution and a compiled current-main runtime were not run.
The public capture path takes DOMSnapshot.captureSnapshot and passes it directly to captureDom in capturePageDom. XML-prefixed names are explicitly retained as XML input in xmlDocument.

Typed outcome or recovery expected

Both retained destination rows should contain the current document URL. A proposed restoration check is to compare prefixed and unprefixed XHTML fixtures with the same base/action values against the browser's native properties.

Analysis or suspected cause

Source-derived: nodeName is used as a lowercased qualified name, so h:form never equals form and h:button never equals button. Both miss usesDocumentUrl and pass the empty attribute through ordinary base resolution. This is distinct from a source URL or namespace authorization problem.

Additional context

Related closed report #820 covers empty destinations on unprefixed form/button/input names. Its fix is present, and the unprefixed XHTML control passes; this report concerns the prefixed XHTML trigger that still bypasses that logic. All-state searches for formaction and XHTML/form found no report of that trigger. No separate reverification or independent semantic-review pass was performed after drafting.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A supported passive browser capture returns the wrong form destinations for a bounded valid XHTML input; the native-browser comparison and unprefixed control establish the error.
Workaround status: unverified
Workaround basis: Changing the analyzed document to remove namespace prefixes is a demonstrated control, but it changes the target and is not an established passive-analysis workaround; no REA override was verified.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6561 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior A production-boundary reproduction with rea-agents 6.7.0 and a real Chromium DOMSnapshot returned the document's /assets/ base URL for an empty action on an XHTML h:form and an empty formaction on h:button. Chromium's native action and formAction properties both returned the current document URL. The identical document using unprefixed XHTML elements produced the correct REA destinations. ## Reproduction 1. Serve the following document at /root/prefixed.xhtml with Content-Type: application/xhtml+xml; the fixture server and browser were disposable. ```xml <h:html xmlns:h="http://www.w3.org/1999/xhtml"><h:head><h:base href="/assets/"/></h:head><h:body><h:form id="form" action=""><h:button id="button" formaction="">Go</h:button></h:form></h:body></h:html> ``` 2. In headless Chromium, load the document, call DOMSnapshot.captureSnapshot with computedStyles: [], and pass the actual snapshot to REA's shipped captureDom with an inspectWebPageInputSchema-parsed input whose allowed_origins contains the fixture origin. 3. Compare captureDom's action and formaction URL rows with document.getElementById('form').action and document.getElementById('button').formAction. Both REA rows end in /assets/; both native properties end in /root/prefixed.xhtml. One focused run of this fixture and its control showed this difference. 4. As the control, remove the h: prefixes and put xmlns="http://www.w3.org/1999/xhtml" on html. REA and Chromium then both return /root/control.xhtml for the equivalent control document. The public affected entry point is inspect_web_page on this HTTP-served document with its origin allowed. A full CLI/MCP request was not run; execution covered the real browser snapshot and the production projection boundary. ## Expected behavior Empty actions on elements in the XHTML namespace should retain the current-document rule regardless of their namespace prefix. The native Chromium properties establish the expected destinations for this fixture, and REA already implements the rule for the unprefixed names in [domMetadata](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/CdpCaptureDocuments.ts#L643-L656). ## Impact and scope Form-navigation evidence is wrong for prefixed XHTML forms or submit controls when a base URL differs from the document URL. The fixture demonstrates both affected attributes and an unprefixed control; population frequency and other XML element variants were not measured. No target files or real browser profiles were modified. ## REA version Observed with npm rea-agents 6.7.0, tag rea-agents-6.7.0 at 27dc42d10249f0410904a75c0997842eb03b931c. Current main 6bb4f4bf7d64e5d2f47479d46225a5383b57cdad has identical CdpCaptureDocuments.ts and CdpCaptureDomSvg.ts source. Current-main runtime scope is source-derived, not executed. ## Runtime and platform Node.js v26.12.1; Linux x86_64; Chromium 155.0.8059.84; headless Playwright connection to a disposable browser. ## Target and artifact context An HTTP-served application/xhtml+xml document with XHTML namespace-prefixed form and button elements and a same-origin base href. ## Interface Other ## Earliest failure stage Capture or observation ## Relevant output or evidence - Expected source: Native Chromium action and formAction properties both returned the fixture document URL; the unprefixed control agreed with REA. - Failure source: REA captureDom returned action and formaction rows pointing to the /assets/ base URL for the prefixed fixture. - Evidence provenance: observed production-boundary output on 6.7.0, with source-derived current-main reachability. - Local verification: reproduced at the production projection boundary; full CLI/MCP execution and a compiled current-main runtime were not run. - The public capture path takes DOMSnapshot.captureSnapshot and passes it directly to captureDom in [capturePageDom](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/CdpPageCapture.ts#L279-L296). XML-prefixed names are explicitly retained as XML input in [xmlDocument](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/CdpCaptureDomSvg.ts#L56-L79). ## Typed outcome or recovery expected Both retained destination rows should contain the current document URL. A proposed restoration check is to compare prefixed and unprefixed XHTML fixtures with the same base/action values against the browser's native properties. ## Analysis or suspected cause Source-derived: nodeName is used as a lowercased qualified name, so h:form never equals form and h:button never equals button. Both miss usesDocumentUrl and pass the empty attribute through ordinary base resolution. This is distinct from a source URL or namespace authorization problem. ## Additional context Related closed report [#820](https://github.com/morluto/rea/issues/820) covers empty destinations on unprefixed form/button/input names. Its fix is present, and the unprefixed XHTML control passes; this report concerns the prefixed XHTML trigger that still bypasses that logic. All-state searches for formaction and XHTML/form found no report of that trigger. No separate reverification or independent semantic-review pass was performed after drafting. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A supported passive browser capture returns the wrong form destinations for a bounded valid XHTML input; the native-browser comparison and unprefixed control establish the error. - Workaround status: unverified - Workaround basis: Changing the analyzed document to remove namespace prefixes is a demonstrated control, but it changes the target and is not an established passive-analysis workaround; no REA override was verified.

bsakaguchi closed this issue

2026-10-31 00:45:31 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:34 +00:00

[PR #4114] [MERGED] fix(apple): bound Interface Builder XML plists by shared value depth #6065

bsakaguchi referenced this issue

2026-11-01 21:12:29 +00:00

[GH-ISSUE #8407] [Bug] decode-interface-builder omits a nib with an empty DOCTYPE internal subset as aggregate decode budget exhaustion #6590