[GH-ISSUE #8626] [Bug] HTML artifact analysis silently omits executable SVG scripts #7500

New issue

Closed

opened 2026-11-03 00:30:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 00:30:16 +00:00

Owner

Originally created by @xu91102 on GitHub (Nov 2, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8626

Before submitting

Searched related open/closed issues and actual production diffs.
Reproduction uses authored local fixtures, with no private target data.

Observed behavior

On fresh main 8250bf2320ea57aab4e664db4b4d44b8abd2004e, analyze-javascript-application records ordinary HTML inline JavaScript as an unavailable scope, but silently omits an executable SVG script embedded in that same HTML document.

Smallest authored input:

<!doctype html><svg><script>window.__reaMarker="ran";</script></svg>

Create index.html with that content and main.js with export const control = 1;, then:

node scripts/rea.mjs analyze-javascript-application /absolute/fixture --source-path index.html --source-path main.js --format json

The command exits 0, but there is no parse-html-inline-scripts observation for index.html, no inline-script count/location, and no corresponding inline-body limitation. Replacing the SVG wrapper with a normal HTML script produces count 1 and its unavailable-scope disclosure. All four original CLI controls preserved input hashes.

Independent execution control

Actual Chrome 156 on macOS, through a loopback HTTP server serving only authored fixtures:

HTML inline script: marker is ran; REA records count 1.
SVG inline script: marker is ran, DOM namespace is http://www.w3.org/2000/svg; REA omits it.
Template-contained script and SVG type="application/json": marker remains absent; REA's omission is correct for these controls.

Ten additional native controls confirm namespace-specific rules: SVG src does not suppress its inline body; href / xlink:href select an external script instead; even empty href suppresses the body. HTML-only language="vbscript" does not disable SVG JavaScript; JavaScript MIME types and exact case-insensitive module execute, whitespace-padded module and a parameterized MIME string do not in this Chrome control. No analyzed target was executed by REA; the browser executed only these authored marker fixtures.

Expected behavior and scope

The shared HTML artifact reference producer should preserve executable SVG script references and inline-body coordinates under their SVG attribute rules, using the existing unavailable-inline-scope contract. Do not claim the bodies have been analyzed or executed, invent endpoints from skipped text, traverse inert template content, change source identity, or add a new parser/schema/runtime capability. Both CLI and MCP should inherit the same source facts.

SVG 2 script semantics define SVG script content and href; the native controls above establish the tested browser behavior. Other browsers/OSes, packaged REA and MCP are NOT_RUN in this report.

Cause and duplicate check

Source-derived: htmlArtifactReferences gates all script handling on the HTML namespace. Existing unit input <svg><script>run();</script></svg> also expects no inline body. This is a false omission, not conservative uncertainty about a dynamic expression.

Read actual related producer hunks of #2940/#2935 (HTML inline count/location), #8525 (decoded inline text for static audit), #2094 (HTML policy meta), #3622 (ASCII helper); #7044 adds public CLI coverage without changing admission. None corrects SVG namespace/source admission. Browser DOM-link work #2480/#1683/#1602 has a different owner and URL-capture purpose. No foreign head was executed. Broader unrelated changes were not presented as fully reviewed.

Environment

REA 6.8.0 source 8250bf2320ea57aab4e664db4b4d44b8abd2004e, Node 24.22.1, macOS arm64; real Chrome 156. Authored examples only; real-world prevalence is not established.

Originally created by @xu91102 on GitHub (Nov 2, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8626 ### Before submitting - [x] Searched related open/closed issues and actual production diffs. - [x] Reproduction uses authored local fixtures, with no private target data. ### Observed behavior On fresh main `8250bf2320ea57aab4e664db4b4d44b8abd2004e`, `analyze-javascript-application` records ordinary HTML inline JavaScript as an unavailable scope, but silently omits an executable SVG script embedded in that same HTML document. Smallest authored input: ```html <!doctype html><svg><script>window.__reaMarker="ran";</script></svg> ``` Create `index.html` with that content and `main.js` with `export const control = 1;`, then: ```sh node scripts/rea.mjs analyze-javascript-application /absolute/fixture --source-path index.html --source-path main.js --format json ``` The command exits 0, but there is no `parse-html-inline-scripts` observation for `index.html`, no inline-script count/location, and no corresponding inline-body limitation. Replacing the SVG wrapper with a normal HTML script produces count 1 and its unavailable-scope disclosure. All four original CLI controls preserved input hashes. ### Independent execution control Actual Chrome 156 on macOS, through a loopback HTTP server serving only authored fixtures: - HTML inline script: marker is `ran`; REA records count 1. - SVG inline script: marker is `ran`, DOM namespace is `http://www.w3.org/2000/svg`; REA omits it. - Template-contained script and SVG `type="application/json"`: marker remains absent; REA's omission is correct for these controls. Ten additional native controls confirm namespace-specific rules: SVG `src` does not suppress its inline body; `href` / `xlink:href` select an external script instead; even empty `href` suppresses the body. HTML-only `language="vbscript"` does not disable SVG JavaScript; JavaScript MIME types and exact case-insensitive `module` execute, whitespace-padded `module` and a parameterized MIME string do not in this Chrome control. No analyzed target was executed by REA; the browser executed only these authored marker fixtures. ### Expected behavior and scope The shared HTML artifact reference producer should preserve executable SVG script references and inline-body coordinates under their SVG attribute rules, using the existing unavailable-inline-scope contract. Do not claim the bodies have been analyzed or executed, invent endpoints from skipped text, traverse inert template content, change source identity, or add a new parser/schema/runtime capability. Both CLI and MCP should inherit the same source facts. [SVG 2 script semantics](https://www.w3.org/TR/SVG2/interact.html#ScriptElement) define SVG script content and href; the native controls above establish the tested browser behavior. Other browsers/OSes, packaged REA and MCP are NOT_RUN in this report. ### Cause and duplicate check Source-derived: `htmlArtifactReferences` gates all script handling on the HTML namespace. Existing unit input `<svg><script>run();</script></svg>` also expects no inline body. This is a false omission, not conservative uncertainty about a dynamic expression. Read actual related producer hunks of #2940/#2935 (HTML inline count/location), #8525 (decoded inline text for static audit), #2094 (HTML policy meta), #3622 (ASCII helper); #7044 adds public CLI coverage without changing admission. None corrects SVG namespace/source admission. Browser DOM-link work #2480/#1683/#1602 has a different owner and URL-capture purpose. No foreign head was executed. Broader unrelated changes were not presented as fully reviewed. ### Environment REA 6.8.0 source `8250bf2320ea57aab4e664db4b4d44b8abd2004e`, Node 24.22.1, macOS arm64; real Chrome 156. Authored examples only; real-world prevalence is not established.

bsakaguchi closed this issue

2026-11-03 00:30:16 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7500

No description provided.

Rows
Columns