svg_conform 0.2.4 → 0.2.6

data/spec/svg_conform/profiles/svg_2_secure_static_profile_spec.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "SVG 2 secure-static profile" do # rubocop:disable RSpec/DescribeClass
+  let(:profile) { SvgConform::Profiles.get("svg_2_secure_static") }
+  let(:citation) do
+    "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+  end
+  let(:root) { "spec/fixtures/profiles/svg_2_secure_static" }
+
+  def dom_report(path)
+    profile.validate(SvgConform::Document.from_file(path))
+  end
+
+  def sax_report(path)
+    SvgConform::SaxDocument.from_file(path).validate_with_profile(profile)
+  end
+
+  def summary(result)
+    result.errors.map do |e|
+      [e.requirement_id, e.data[:citation]]
+    end.sort
+  end
+
+  it "is discoverable, opt-in and dated" do
+    expect(SvgConform::Profiles.list).to include("svg_2_secure_static")
+    expect(profile.specification_uri).to include("CR-SVG2-20261006")
+    default = SvgConform::Cli.commands["check"].options[:profile].default
+    expect(default).to eq("svg_1_2_rfc")
+  end
+
+  it "defines the four stable requirement ids with the dated citation" do
+    categories = profile.requirements.first.categories
+    ids = categories.map(&:id) + [profile.requirements.last.id]
+    expect(ids).to eq(%w[svg2.secure_static.script svg2.secure_static.animation
+                         svg2.secure_static.interaction
+                         svg2.secure_static.external_reference])
+    expect(categories.map(&:citation).uniq).to eq([citation])
+    expect(profile.requirements.last.citation_uri).to eq(citation)
+  end
+
+  it "uses the unchanged Card 03 requirement class and shape" do
+    expect(profile.requirements.first)
+      .to be_a(SvgConform::Requirements::ProcessingFeaturesRequirement)
+    expect(profile.requirements.first.categories.first.class.attributes.keys)
+      .to eq(%i[name id citation description elements attributes
+                attribute_patterns])
+  end
+
+  Dir.glob("spec/fixtures/profiles/svg_2_secure_static/valid/*.svg").each do |path|
+    it "accepts #{File.basename(path)} through DOM and SAX" do
+      expect(dom_report(path).errors).to be_empty
+      expect(sax_report(path).errors).to be_empty
+    end
+  end
+
+  {
+    "script" => "svg2.secure_static.script",
+    "animation" => "svg2.secure_static.animation",
+    "interaction" => "svg2.secure_static.interaction",
+  }.each do |name, id|
+    it "rejects #{name}.svg only with #{id}, matching DOM and SAX" do
+      path = "#{root}/invalid/#{name}.svg"
+      expect(dom_report(path).errors.map(&:requirement_id).uniq).to eq([id])
+      expect(summary(sax_report(path))).to eq(summary(dom_report(path)))
+      expect(summary(sax_report(path)).first.last).to eq(citation)
+    end
+  end
+
+  def self.external_fixtures
+    Dir.glob("spec/fixtures/profiles/svg_2_secure_static/invalid/*.svg")
+      .map { |f| File.basename(f, ".svg") } - %w[script animation interaction]
+  end
+
+  it "enumerates the external-reference corpus" do
+    expect(self.class.external_fixtures.size).to eq(18)
+  end
+
+  external_fixtures.each do |name|
+    it "rejects #{name}.svg with external_reference, matching DOM and SAX" do
+      path = "#{root}/invalid/#{name}.svg"
+      expect(dom_report(path).errors.map(&:requirement_id).uniq)
+        .to eq(["svg2.secure_static.external_reference"])
+      expect(summary(sax_report(path))).to eq(summary(dom_report(path)))
+      expect(dom_report(path).errors.first.data[:citation]).to eq(citation)
+    end
+  end
+
+  it "emits a LensCore report with the profile citation" do
+    report = SvgConform::Diagnostics::LensCoreAdapter.call(
+      sax_report("#{root}/invalid/http.svg"),
+    )
+    expect(report.valid).to be false
+    expect(report.profile.id).to eq("svg_2_secure_static")
+  end
+
+  def inline_ids(body)
+    xml = %(<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1 1">#{body}</svg>)
+    dom = profile.validate(SvgConform::Document.from_content(xml)).errors
+    sax = SvgConform::SaxDocument.from_content(xml)
+      .validate_with_profile(profile).errors
+    expect(sax.map(&:requirement_id)).to eq(dom.map(&:requirement_id))
+    dom.map(&:requirement_id)
+  end
+
+  {
+    "unlisted pointer handler" => ['<rect onpointerdown="x()"/>',
+                                   %w[svg2.secure_static.interaction]],
+    "unlisted drag handler" => ['<rect ondragstart="x()"/>',
+                                %w[svg2.secure_static.interaction]],
+    "listed load handler keeps script id" => ['<rect onload="x()"/>',
+                                              %w[svg2.secure_static.script]],
+    "listed click handler is reported once" => ['<rect onclick="x()"/>',
+                                                %w[svg2.secure_static.interaction]],
+    "listed begin handler keeps animation id" => ['<rect onbegin="x()"/>',
+                                                  %w[svg2.secure_static.animation]],
+    "style attribute animation" => ['<rect style="animation: pulse 1s infinite"/>',
+                                    %w[svg2.secure_static.animation]],
+    "style attribute vendor transition" => ['<rect style="fill:red;-webkit-transition: all 1s"/>',
+                                            %w[svg2.secure_static.animation]],
+    "style attribute escaped animation" => ['<rect style="\\61nimation-name: pulse"/>',
+                                            %w[svg2.secure_static.animation]],
+    "style element animation" => ["<style>rect { animation: pulse 1s }</style>",
+                                  %w[svg2.secure_static.animation]],
+    "style element keyframes" => ["<style>@keyframes pulse { from { opacity: 0 } }</style>",
+                                  %w[svg2.secure_static.animation]],
+    "style element nested media animation" => ["<style>@media print { a { transition: all 1s } }</style>",
+                                               %w[svg2.secure_static.animation]],
+    "static css is accepted" => ['<style>rect { fill: red } a:hover { fill: blue }</style><rect style="fill: red"/>', []],
+    "animation word in selector or value is accepted" => ['<style>.animation { fill: red }</style><rect style="font-family: animation"/>', []],
+  }.each do |label, (body, expected)|
+    it "#{label}: #{expected.inspect} through DOM and SAX" do
+      expect(inline_ids(body)).to eq(expected)
+    end
+  end
+
+  it "reports external CSS references hidden by escapes through DOM and SAX" do
+    bodies = [
+      '<rect style="fill:u\\72l(https://example.com/x.png)"/>',
+      '<rect style="fill:\\75rl(https://example.com/x.png)"/>',
+      '<style>@\\69mport "https://example.com/a.css";</style>',
+      '<style>@IMP\\4frt url(https://example.com/a.css);</style>',
+    ]
+    bodies.each do |body|
+      expect(inline_ids(body)).to eq(["svg2.secure_static.external_reference"]),
+                                  body
+    end
+  end
+end

data/spec/svg_conform/profiles_plantuml_spec.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "nokogiri"
+
+RSpec.describe SvgConform::Profiles do
+  let(:validator) { SvgConform::Validator.new(mode: :sax) }
+  let(:profile) { described_class.get(:metanorma) }
+  let(:plantuml_attributes) { %w[contentstyletype zoomandpan title textlength lengthadjust] }
+  let(:svg) do
+    <<~SVG
+      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
+           version="1.2" baseProfile="tiny" viewBox="0 0 120 30"
+           contentStyleType="text/css" zoomAndPan="magnify">
+        <a xlink:href="https://example.test/UnitType" title="UnitType">
+          <text id="label" x="0" y="12" textLength="100" lengthAdjust="spacing">UnitType</text>
+        </a>
+      </svg>
+    SVG
+  end
+
+  it "accepts the five explicit layout and link attributes" do
+    result = validator.validate(svg, profile: profile)
+    expect(result.errors.map(&:message)).to be_empty
+  end
+
+  %w[svg text a].each do |element|
+    it "still rejects unrelated attributes on #{element}" do
+      invalid = svg.sub("<#{element} ", "<#{element} unsupported-plantuml-setting=\"no\" ")
+      result = validator.validate(invalid, profile: profile)
+      expect(result.errors.map(&:message).join).to include("unsupported-plantuml-setting")
+    end
+  end
+
+  { "svg" => "textLength", "text" => "zoomAndPan", "a" => "lengthAdjust" }.each do |element, attribute|
+    it "rejects #{attribute} on #{element}" do
+      invalid = svg.sub("<#{element} ", "<#{element} #{attribute}=\"1\" ")
+      result = validator.validate(invalid, profile: profile)
+      expect(result.errors.map(&:message).join.downcase).to include("attribute '#{attribute.downcase}' is not allowed")
+    end
+  end
+
+  %i[svg_1_2_rfc svg_1_2_rfc_with_rdf].each do |strict_profile|
+    it "keeps #{strict_profile} attribute restrictions unchanged" do
+      result = validator.validate(svg, profile: strict_profile)
+      messages = result.errors.map(&:message).join.downcase
+      plantuml_attributes.each do |attribute|
+        expect(messages).to include("attribute '#{attribute}' is not allowed")
+      end
+    end
+  end
+
+  it "preserves native PlantUML text measurements and links during remediation" do
+    source = File.read("spec/fixtures/plantuml/unit-type.svg")
+    document = SvgConform::Document.from_content(source)
+    result = validator.validate(source, profile: profile)
+    SvgConform::RemediationEngine.new(profile).apply_remediations(document, result)
+    output = document.root.to_xml
+    errors = validator.validate(output, profile: profile).errors
+      .reject { |error| error.violation_type == :reference_violation }
+
+    # The fixture's fragment targets belong to the surrounding HTML document.
+    expect(errors.map(&:message)).to be_empty
+    expect(text_layout(output)).to eq(text_layout(source))
+    expect(text_layout(output).size).to eq(28)
+    expect(diagram_links(output)).to eq(diagram_links(source))
+    expect(diagram_links(output).size).to eq(12)
+  end
+
+  def text_layout(xml)
+    Nokogiri::XML(xml).xpath("//svg:text", "svg" => "http://www.w3.org/2000/svg").map do |node|
+      [node.text, node["x"], node["y"], node["textLength"], node["lengthAdjust"]]
+    end
+  end
+
+  def diagram_links(xml)
+    Nokogiri::XML(xml).xpath("//svg:a", "svg" => "http://www.w3.org/2000/svg").map do |node|
+      [node["title"], node.attribute_with_ns("href", "http://www.w3.org/1999/xlink")&.value]
+    end
+  end
+end

data/spec/svg_conform/references/data_uri_reference_spec.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "base64"
+require "zlib"
+
+RSpec.describe SvgConform::References::DataUriReference do
+  def ref(value)
+    SvgConform::References::ReferenceClassifier.classify(
+      value, element_name: "image", attribute_name: "href"
+    )
+  end
+
+  def chunk(type, data)
+    [data.bytesize].pack("N") + type + data + [Zlib.crc32(type + data)].pack("N")
+  end
+
+  let(:png) do
+    "\x89PNG\r\n\x1A\n".b +
+      chunk("IHDR", [1, 1, 8, 2, 0, 0, 0].pack("NNCCCCC")) +
+      chunk("IDAT", Zlib::Deflate.deflate("\x00\xFF\x00\x00".b)) +
+      chunk("IEND", "")
+  end
+  let(:jpeg) { "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xFF\xD9".b }
+
+  it "decodes base64 and percent-encoded payloads to the same bytes" do
+    pct = png.each_byte.map { |b| format("%%%02X", b) }.join
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(png)}").payload)
+      .to eq(png)
+    expect(ref("data:image/png,#{pct}").payload).to eq(png)
+  end
+
+  it "reports base64? and a normalized media type" do
+    r = ref("data:IMAGE/PNG;base64,AAAA")
+    expect(r.base64?).to be true
+    expect(r.normalized_media_type).to eq("image/png")
+    expect(ref("data:,hello").normalized_media_type).to eq("text/plain")
+  end
+
+  it "accepts well-formed PNG and JPEG payloads" do
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(png)}")
+      .raster_error).to be_nil
+    expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(jpeg)}")
+      .raster_error).to be_nil
+  end
+
+  {
+    "data:image/png;base64," => /empty/,
+    "data:image/png;base64,!!!" => /malformed base64/,
+    "data:image/png,%G1" => /percent/,
+    "data:image/png" => /separator/,
+    "data:image/png;base64,bm90IGEgcG5n" => /not a PNG/,
+    "data:image/jpeg;base64,bm90IGEganBn" => /not a JPEG/,
+  }.each do |value, pattern|
+    it "rejects #{value}" do
+      expect(ref(value).raster_error).to match(pattern)
+    end
+  end
+
+  {
+    "APP0 declaring more bytes than present" => "\xFF\xD8\xFF\xE0\x00\x10\xFF\xD9",
+    "segment length below two" => "\xFF\xD8\xFF\xE0\x00\x01\xFF\xD9",
+    "marker without length" => "\xFF\xD8\xFF",
+    "stray non-marker byte" => "\xFF\xD8\xFF\xE0\x00\x02\x41\xFF\xD9",
+    "end marker inside the data before the end" => "\xFF\xD8\xFF\xD9\x00\x00",
+    "no end of image" => "\xFF\xD8\xFF\xE0\x00\x02",
+    "SOS scan without end of image" => "\xFF\xD8\xFF\xDA\x00\x02\x01\x02\x03",
+  }.each do |label, bytes|
+    it "rejects a malformed JPEG (#{label}) in base64 and percent forms" do
+      raw = bytes.b
+      pct = raw.each_byte.map { |b| format("%%%02X", b) }.join
+      expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(raw)}").raster_error)
+        .to include("JPEG")
+      expect(ref("data:image/jpeg,#{pct}").raster_error).to include("JPEG")
+    end
+  end
+
+  it "accepts a JPEG with a scan, byte stuffing and restart markers" do
+    scan = "\xFF\xD8\xFF\xE0\x00\x04\x00\x00\xFF\xDA\x00\x04\x01\x02\x11\xFF\x00\x22\xFF\xD0\x33\xFF\xD9".b
+    expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(scan)}").raster_error)
+      .to be_nil
+  end
+
+  it "detects PNG checksum corruption and truncation" do
+    bad = png.dup
+    bad.setbyte(20, bad.getbyte(20) ^ 0xFF)
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(bad)}")
+      .raster_error).to match(/checksum|IHDR/)
+    cut = png.byteslice(0, png.bytesize - 6)
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(cut)}")
+      .raster_error).not_to be_nil
+  end
+
+  it "stays internal in validation_scope" do
+    expect(ref("data:image/png,x").validation_scope).to eq(:internal)
+  end
+end

data/spec/svg_conform/references/integration_spec.rb

@@ -203,4 +203,34 @@ RSpec.describe "Reference Manifest Integration" do
       expect(manifest_data).to have_key(:statistics)
     end
   end
+
+  describe "secure-static profile shares the classifier" do
+    it "registers the same reference types the link requirement sees" do
+      svg = <<~SVG
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
+          <rect id="a" width="1" height="1"/>
+          <use href="#a"/>
+          <use href="other.svg#a"/>
+        </svg>
+      SVG
+      profile = SvgConform::Profile.new(
+        name: "both",
+        requirements: [
+          SvgConform::Requirements::LinkValidationRequirement.new(id: "link"),
+          SvgConform::Requirements::ExternalReferencesRequirement.new(
+            id: "svg2.secure_static.external_reference",
+          ),
+        ],
+      )
+      result = SvgConform::SaxDocument.from_content(svg)
+        .validate_with_profile(profile)
+      manifest = result.reference_manifest.to_h
+      types = (manifest[:internal_references] + manifest[:external_references])
+        .map { |r| r[:type] }
+      expect(types).to contain_exactly("InternalFragmentReference",
+                                       "RelativePathReference")
+      expect(result.errors.map(&:requirement_id))
+        .to include("svg2.secure_static.external_reference")
+    end
+  end
 end

data/spec/svg_conform/references/reference_classifier_spec.rb

@@ -138,5 +138,22 @@ RSpec.describe SvgConform::References::ReferenceClassifier do
       expect(ref.line_number).to eq(42)
       expect(ref.column_number).to eq(15)
     end
+
+    it "keeps typed returns and the classify signature for secure-static inputs" do
+      expect(described_class.method(:classify).parameters).to eq(
+        [%i[req href_value], %i[keyreq element_name], %i[keyreq attribute_name],
+         %i[key line_number], %i[key column_number]],
+      )
+      {
+        "//example.com/a.png" => SvgConform::References::RelativePathReference,
+        "other.svg#id" => SvgConform::References::RelativePathReference,
+        "file:///etc/passwd#id" => SvgConform::References::RelativePathReference,
+        "DATA:image/png,x" => SvgConform::References::DataUriReference,
+      }.each do |value, klass|
+        ref = described_class.classify(value, element_name: "use",
+                                              attribute_name: "href")
+        expect(ref).to be_a(klass), value
+      end
+    end
   end
 end

data/spec/svg_conform/requirements/external_references_requirement_spec.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "base64"
+
+RSpec.describe SvgConform::Requirements::ExternalReferencesRequirement do
+  let(:requirement) do
+    described_class.new(id: "ext", citation_uri: "https://example.test/cite")
+  end
+  let(:profile) { SvgConform::Profile.new(name: "x", requirements: [requirement]) }
+  let(:ns) { 'xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"' }
+
+  def svg(body, pre: "")
+    %(#{pre}<svg #{ns} viewBox="0 0 1 1">#{body}</svg>)
+  end
+
+  def dom(xml)
+    profile.validate(SvgConform::Document.from_content(xml))
+  end
+
+  def sax(xml)
+    SvgConform::SaxDocument.from_content(xml).validate_with_profile(profile)
+  end
+
+  def b64_svg(inner)
+    "data:image/svg+xml;base64,#{Base64.strict_encode64(inner)}"
+  end
+
+  {
+    "same-document href" => ['<use href="#a"/>', 0],
+    "same-document xlink:href" => ['<use xlink:href="#a"/>', 0],
+    "http href" => ['<image href="http://e.test/a.png"/>', 1],
+    "xlink http href" => ['<image xlink:href="https://e.test/a.png"/>', 1],
+    "anchor to web" => ['<a href="https://e.test/">x</a>', 1],
+    "presentation url" => ['<rect fill="url(other.svg#g)"/>', 1],
+    "presentation fragment" => ['<rect fill="url(#g)"/>', 0],
+    "style attribute url" => ['<rect style="fill:url(&quot;x.svg#g&quot;)"/>', 1],
+    "style element import string" => ['<style>@import "a.css";</style>', 1],
+    "style element import url counted once" => ["<style>@import url(a.css);</style>", 1],
+    "style element url" => ["<style>a{fill:url(a.svg#x)}</style>", 1],
+    "css comment ignored" => ["<style>/* url(a.svg) */ a{fill:red}</style>", 0],
+    "escaped url function" => ['<rect style="fill:u\\72l(https://e.test/x.png)"/>', 1],
+    "escaped url function uppercase hex" => ['<rect style="fill:\\55RL(https://e.test/x.png)"/>', 1],
+    "escaped url in presentation attribute" => ['<rect fill="u\\72l(https://e.test/x.png)"/>', 1],
+    "escaped url with quoted string" => ['<rect style="fill:u\\72l(\'https://e.test/x.png\')"/>', 1],
+    "escaped characters inside the url" => ['<rect style="fill:url(\\68ttps://e.test/x.png)"/>', 1],
+    "escaped import string" => ['<style>@\\69mport "a.css";</style>', 1],
+    "escaped import url" => ['<style>@imp\\6frt url(a.css);</style>', 1],
+    "escaped import with escaped url" => ['<style>@\\69mport u\\72l(a.css);</style>', 1],
+    "url text inside a css string is not a reference" => ['<style>a{content:"url(a.svg)"}</style>', 0],
+    "escaped url with same-document fragment" => ['<rect style="fill:u\\72l(#g)"/>', 0],
+    "javascript scheme" => ['<a href="javascript:x()">x</a>', 1],
+  }.each do |label, (body, count)|
+    it "#{label}: #{count} finding(s) through DOM and SAX" do
+      xml = svg(body)
+      expect(dom(xml).errors.size).to eq(count)
+      expect(sax(xml).errors.map(&:message)).to eq(dom(xml).errors.map(&:message))
+    end
+  end
+
+  it "reports xml-stylesheet processing instructions from the source" do
+    xml = svg("", pre: %(<?xml-stylesheet href="a.css"?>))
+    expect(dom(xml).errors.size).to eq(1)
+    expect(sax(xml).errors.size).to eq(1)
+  end
+
+  it "uses the requirement id and citation in error data" do
+    error = sax(svg('<image href="//e.test/a.png"/>')).errors.first
+    expect(error.requirement_id).to eq("ext")
+    expect(error.data).to include(citation: "https://example.test/cite",
+                                  reference_type: "RelativePathReference")
+  end
+
+  describe "nested SVG data URLs" do
+    let(:plain) { '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>' }
+
+    it "accepts a self-contained SVG" do
+      expect(sax(svg(%(<image href="#{b64_svg(plain)}"/>))).errors).to be_empty
+    end
+
+    it "rejects malformed XML, non-svg roots and external entities" do
+      ["<svg><g></svg>", "<html/>",
+       %(<!DOCTYPE svg SYSTEM "http://e.test/x.dtd"><svg/>)].each do |bad|
+        errors = sax(svg(%(<image href="#{b64_svg(bad)}"/>))).errors
+        expect(errors.size).to eq(1), bad
+      end
+    end
+
+    it "reports nested external content with a JSON-safe reason" do
+      inner = '<svg xmlns="http://www.w3.org/2000/svg"><image href="http://e.test/a"/></svg>'
+      error = dom(svg(%(<image href="#{b64_svg(inner)}"/>))).errors.first
+      expect(error.data[:reason]).to match(/nested href 'http:\/\/e.test\/a'/)
+      expect { JSON.generate(error.data) }.not_to raise_error
+    end
+
+    it "limits nesting depth" do
+      nest = plain
+      4.times do
+        nest = %(<svg xmlns="http://www.w3.org/2000/svg"><image href="#{b64_svg(nest)}"/></svg>)
+      end
+      error = sax(svg(%(<image href="#{b64_svg(nest)}"/>))).errors.first
+      expect(error.data[:reason]).to include("nesting exceeds 3")
+    end
+  end
+
+  it "ignores empty references like the classifier does" do
+    expect(sax(svg('<image href=""/>')).errors).to be_empty
+  end
+end

data/spec/svg_conform/requirements/link_validation_requirement_spec.rb

@@ -74,4 +74,20 @@ RSpec.describe SvgConform::Requirements::LinkValidationRequirement do
       expect(requirement).to be_a(described_class)
     end
   end
+
+  describe "classifier sharing with ExternalReferencesRequirement" do
+    it "still reports a missing fragment target while external-reference allows the fragment" do
+      svg = '<svg xmlns="http://www.w3.org/2000/svg"><use href="#missing"/></svg>'
+      profile = SvgConform::Profile.new(
+        name: "p",
+        requirements: [
+          described_class.new(id: "link"),
+          SvgConform::Requirements::ExternalReferencesRequirement.new(id: "ext"),
+        ],
+      )
+      ids = SvgConform::SaxDocument.from_content(svg)
+        .validate_with_profile(profile).errors.map(&:requirement_id)
+      expect(ids).not_to include("ext")
+    end
+  end
 end

data/spec/svg_conform/requirements/processing_features_requirement_spec.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "yaml"
+
+RSpec.describe SvgConform::Requirements::ProcessingFeaturesRequirement do
+  let(:config_path) { "config/requirements/processing_features_static.yml" }
+  let(:requirement) { described_class.from_yaml(File.read(config_path)) }
+  let(:profile) do
+    SvgConform::Profile.new(name: "pf", requirements: [requirement])
+  end
+  let(:svg_ns) { 'xmlns="http://www.w3.org/2000/svg"' }
+
+  def svg(body)
+    %(<svg #{svg_ns} version="1.1" viewBox="0 0 10 10">#{body}</svg>)
+  end
+
+  def dom_ids(xml)
+    profile.validate(SvgConform::Document.from_content(xml))
+      .errors.map(&:requirement_id).sort
+  end
+
+  def sax_ids(xml)
+    SvgConform::SaxDocument.from_content(xml).validate_with_profile(profile)
+      .errors.map(&:requirement_id).sort
+  end
+
+  it "loads the three categories from YAML with separate ids and citations" do
+    expect(requirement.categories.map(&:name))
+      .to eq(%w[script animation interaction])
+    expect(requirement.categories.map(&:id)).to eq(
+      %w[svg11.processing.script svg11.processing.animation
+         svg11.processing.interaction],
+    )
+    expect(requirement.categories.map(&:citation).uniq.size).to eq(1)
+  end
+
+  it "resolves through a profile YAML via the requirement class map" do
+    entry = File.read(config_path).lines.each_with_index.map do |l, i|
+      i.zero? ? "  - #{l}" : "    #{l}"
+    end.join
+    yaml = "name: x\nrequirements:\n#{entry}"
+    loaded = SvgConform::Profile.from_yaml(yaml)
+    expect(loaded.requirements.first).to be_a(described_class)
+  end
+
+  it "is registered in Requirements.all" do
+    expect(SvgConform::Requirements.all).to include(described_class)
+  end
+
+  {
+    "script element" => ["<script>x()</script>", %w[svg11.processing.script]],
+    "load handler" => ['<rect onload="x()" width="1" height="1"/>',
+                       %w[svg11.processing.script]],
+    "animate element" => ['<rect width="1" height="1"><animate attributeName="x" dur="1s"/></rect>',
+                          %w[svg11.processing.animation svg11.processing.animation]],
+    "click handler" => ['<rect onclick="x()" width="1" height="1"/>',
+                        %w[svg11.processing.interaction]],
+    "cursor attribute" => ['<rect cursor="pointer" width="1" height="1"/>',
+                           %w[svg11.processing.interaction]],
+    "clean static" => ['<rect width="1" height="1"/>', []],
+  }.each do |label, (body, expected)|
+    it "reports #{label} identically through DOM and SAX" do
+      xml = svg(body)
+      expect(dom_ids(xml)).to eq(expected)
+      expect(sax_ids(xml)).to eq(expected)
+    end
+  end
+
+  it "attaches the category citation to the error" do
+    error = SvgConform::SaxDocument.from_content(svg("<script/>"))
+      .validate_with_profile(profile).errors.first
+    expect(error.data[:citation]).to eq(requirement.categories.first.citation)
+  end
+end