morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2479] [Bug] Browser inspection reports false SVG links inside desc and title #823

New issue

Closed

opened 2026-10-15 18:28:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:28:46 +00:00

Owner

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2479

Observed behavior

inspect_web_page / rea inspect-web-page reports xlink:href on HTML anchors inside an SVG desc or title as an SVG href destination. Chrome does not treat these anchors as links.

This adds false URL evidence that an agent may use when tracing navigation or reconstructing a web application.

Reproduction

Serve this page as text/html on a local HTTP server and open it in Chrome with a local CDP endpoint:

<!doctype html>
<svg>
  <desc><a id="desc" xlink:href="/false-desc">description</a></desc>
  <title><a id="title" xlink:href="/false-title">title</a></title>
  <a xlink:href="/true-svg"><text>real SVG link</text></a>
</svg>

Inspect the selected page:

rea inspect-web-page http://127.0.0.1:9222 PAGE_TARGET_ID --observation-ms 0 --json

The equivalent MCP call is inspect_web_page with cdp_endpoint, target_id, allowed_origins: [LOCAL_PAGE_ORIGIN] and observation_ms: 0.

On the affected revision, normalized_result.metadata.dom_urls contains /false-desc and /false-title, both with attribute: "href" and destination_scope: "approved".

Independent Chrome checks on both anchors return:

element.namespaceURI === "http://www.w3.org/1999/xhtml"
element.matches(":any-link") === false
element.href === ""

Expected behavior and scope

Do not apply the SVG xlink:href fallback to HTML descendants of SVG desc and title. Preserve ordinary HTML href values and resume SVG interpretation inside a nested svg.

XML/XHTML parsing has different namespace rules: explicitly namespaced SVG anchors inside svg:desc / svg:title must remain included. Existing URL sanitization and allowed-origin policy should stay intact.

Executed evidence

Source revision: bb154d1067b0fc250452b7d468d0b0523031a16f (main, package version 6.4.0; the published npm tarball was not tested).
Linux x64, Node 24.18.0, npm 11.16.0, Google Chrome 138.0.7204.157.
Reproduced through both the compiled CLI and a real stdio MCP server against an isolated loopback page.
An expanded page containing five real links returned seven URLs through both interfaces; the two extra URLs were /false-desc and /false-title.
Added regression cases fail on the base: two DOM projection cases and one real-Chrome boundary case fail; the other 51 cases pass.

Root cause

elementInSvgContext in src/browser/CdpCaptureDomSvg.ts stops the HTML ancestry walk only at foreignObject. SVG's other HTML integration points, desc and title, are missing from that boundary.

I searched existing issues and PRs for the symptoms and integration-point handling. Related earlier work: #1602 and #1683; neither addresses this HTML parsing case.

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2479 ## Observed behavior `inspect_web_page` / `rea inspect-web-page` reports `xlink:href` on HTML anchors inside an SVG `desc` or `title` as an SVG `href` destination. Chrome does not treat these anchors as links. This adds false URL evidence that an agent may use when tracing navigation or reconstructing a web application. ## Reproduction Serve this page as `text/html` on a local HTTP server and open it in Chrome with a local CDP endpoint: ```html <!doctype html> <svg> <desc><a id="desc" xlink:href="/false-desc">description</a></desc> <title><a id="title" xlink:href="/false-title">title</a></title> <a xlink:href="/true-svg"><text>real SVG link</text></a> </svg> ``` Inspect the selected page: ```sh rea inspect-web-page http://127.0.0.1:9222 PAGE_TARGET_ID --observation-ms 0 --json ``` The equivalent MCP call is `inspect_web_page` with `cdp_endpoint`, `target_id`, `allowed_origins: [LOCAL_PAGE_ORIGIN]` and `observation_ms: 0`. On the affected revision, `normalized_result.metadata.dom_urls` contains `/false-desc` and `/false-title`, both with `attribute: "href"` and `destination_scope: "approved"`. Independent Chrome checks on both anchors return: ```js element.namespaceURI === "http://www.w3.org/1999/xhtml" element.matches(":any-link") === false element.href === "" ``` ## Expected behavior and scope Do not apply the SVG `xlink:href` fallback to HTML descendants of SVG `desc` and `title`. Preserve ordinary HTML `href` values and resume SVG interpretation inside a nested `svg`. XML/XHTML parsing has different namespace rules: explicitly namespaced SVG anchors inside `svg:desc` / `svg:title` must remain included. Existing URL sanitization and allowed-origin policy should stay intact. ## Executed evidence - Source revision: `bb154d1067b0fc250452b7d468d0b0523031a16f` (main, package version 6.4.0; the published npm tarball was not tested). - Linux x64, Node 24.18.0, npm 11.16.0, Google Chrome 138.0.7204.157. - Reproduced through both the compiled CLI and a real stdio MCP server against an isolated loopback page. - An expanded page containing five real links returned seven URLs through both interfaces; the two extra URLs were `/false-desc` and `/false-title`. - Added regression cases fail on the base: two DOM projection cases and one real-Chrome boundary case fail; the other 51 cases pass. ## Root cause `elementInSvgContext` in `src/browser/CdpCaptureDomSvg.ts` stops the HTML ancestry walk only at `foreignObject`. SVG's other HTML integration points, `desc` and `title`, are missing from that boundary. I searched existing issues and PRs for the symptoms and integration-point handling. Related earlier work: #1602 and #1683; neither addresses this HTML parsing case.

bsakaguchi

2026-10-15 18:28:46 +00:00

closed this issue
added the
bug
label

bsakaguchi referenced this issue

2026-10-16 21:16:30 +00:00

[PR #823] [MERGED] refactor(domain): consolidate property-key extraction behind semanticStaticPropertyKey #2265

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#823

No description provided.

Rows
Columns