svg_conform 0.2.4 → 0.2.7

data/spec/svg_conform/profiles/svg_1_1_full_static_profile_spec.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "svg_conform/profile_compiler"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe "svg_1_1_full_static profile" do # rubocop:disable RSpec/DescribeClass
+  let(:profile) { SvgConform::Profiles.get("svg_1_1_full_static") }
+  let(:fixtures) { File.expand_path("../../fixtures/profiles/svg_1_1_full_static", __dir__) }
+  let(:matrix) do
+    {
+      "svg11.document.xml" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments",
+      "svg11.document.root" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElement",
+      "svg11.document.version" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElementVersionAttribute",
+      "svg11.document.grammar" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments",
+      "svg11.document.css2" => "https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html",
+      "svg11.document.xml_stylesheet" => "https://www.w3.org/TR/1999/REC-xml-stylesheet-19990629/",
+      "svg11.processing.script" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+      "svg11.processing.animation" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+      "svg11.processing.interaction" => "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers",
+    }
+  end
+  let(:invalid_cases) do
+    {
+      "malformed-xml" => "svg11.document.xml",
+      "wrong-namespace" => "svg11.document.root",
+      "wrong-version" => "svg11.document.version",
+      "dtd-content-model" => "svg11.document.grammar",
+      "dtd-attribute" => "svg11.document.grammar",
+      "css-grammar" => "svg11.document.css2",
+      "xml-stylesheet" => "svg11.document.xml_stylesheet",
+      "script" => "svg11.processing.script",
+      "animation" => "svg11.processing.animation",
+      "interaction" => "svg11.processing.interaction",
+    }
+  end
+
+  def fixture(kind, name)
+    File.join(fixtures, kind, "#{name}.svg")
+  end
+
+  def sax_errors(path)
+    SvgConform::SaxDocument.from_file(path).validate_with_profile(profile).errors
+  end
+
+  def dom_errors(path)
+    profile.validate(SvgConform::Document.from_file(path)).errors
+  end
+
+  def ids(errors)
+    errors.map(&:requirement_id).uniq.sort - ["parse_error"]
+  end
+
+  it "is listed, opt-in and does not change the default profile" do
+    expect(SvgConform::Profiles.available_profiles).to include(:svg_1_1_full_static)
+    expect(profile.name).to eq("svg_1_1_full_static")
+    expect(profile.specification_uri)
+      .to eq("https://www.w3.org/TR/2011/REC-SVG11-20110816/")
+    expect(SvgConform::Validator.new.method(:validate).parameters)
+      .to include(%i[key profile])
+    expect(SvgConform::Validator.instance_method(:validate_file)
+      .parameters).to include(%i[key profile])
+    expect(profile.remediations.to_a).to be_empty
+  end
+
+  it "covers the nine stable ids with their normative citations" do
+    declared = profile.requirements.flat_map do |req|
+      req.respond_to?(:categories) ? req.categories.map { |c| [c.id, c.citation] } : [[req.id, req.citation_uri]]
+    end
+    expect(declared.to_h).to eq(matrix)
+  end
+
+  it "builds through the existing class map and compiler" do
+    expect(SvgConform::Profile::REQUIREMENTS_CLASS_MAP)
+      .to include("Svg11DocumentRequirement", "ProcessingFeaturesRequirement")
+    compiled = SvgConform::ProfileCompiler.compile("svg_1_1_full_static")
+    expect(compiled.requirements.map { |req| req.class.name.split("::").last }.uniq)
+      .to eq(%w[Svg11DocumentRequirement ProcessingFeaturesRequirement])
+  end
+
+  %w[minimal-full css xml-stylesheet foreign-metadata].each do |name|
+    it "accepts valid/#{name}.svg identically in DOM and SAX" do
+      path = fixture("valid", name)
+      expect(dom_errors(path)).to be_empty
+      expect(sax_errors(path)).to be_empty
+    end
+  end
+
+  it "rejects each invalid fixture with the expected id in DOM and SAX" do
+    invalid_cases.each do |name, id|
+      path = fixture("invalid", name)
+      sax = ids(sax_errors(path))
+      expect(sax).to include(id), name
+      if name == "malformed-xml"
+        # DOM cannot build a document from malformed XML at all.
+        expect { SvgConform::Document.from_file(path) }
+          .to raise_error(SvgConform::ParseError)
+      else
+        expect(ids(dom_errors(path))).to eq(sax), name
+      end
+    end
+  end
+
+  it "gives every error a normative citation, through issues and LensCore" do
+    invalid_cases.each_key do |name|
+      result = SvgConform::SaxDocument.from_file(fixture("invalid", name)).validate_with_profile(profile)
+      cited = result.errors.reject { |e| e.requirement_id == "parse_error" }
+      expect(cited).not_to be_empty
+      cited.each do |error|
+        expect(matrix.values).to include(error.data[:citation]), "#{name} #{error.requirement_id}"
+      end
+      report = SvgConform::Diagnostics::LensCoreAdapter.call(result)
+      report.diagnostics.each do |diag|
+        next if diag.requirement_id == "parse_error"
+
+        expect(diag.citations.map(&:uri) & matrix.values).not_to be_empty
+      end
+    end
+  end
+
+  it "validates a file input and a string input identically" do
+    path = fixture("invalid", "wrong-version")
+    from_string = SvgConform::SaxDocument.from_content(File.read(path))
+      .validate_with_profile(profile)
+    expect(ids(from_string.errors)).to eq(ids(sax_errors(path)))
+    dom_string = profile.validate(SvgConform::Document.from_content(File.read(path)))
+    expect(ids(dom_string.errors)).to eq(ids(from_string.errors))
+  end
+
+  it "does not claim Tiny or Basic and offers no remediation" do
+    expect(profile.description).not_to match(/tiny|basic/i)
+    expect(profile.remediation_count).to eq(0)
+  end
+
+  it "runs through the CLI check command and prints a JSON report" do
+    command = SvgConform::Commands::Check.new(
+      fixture("valid", "minimal-full"),
+      { profile: "svg_1_1_full_static", format: "json" },
+    )
+    expect do
+      expect { command.execute }.to raise_error(SystemExit) do |error|
+        expect(error.status).to eq(0)
+      end
+    end.to output(/"id": "svg_1_1_full_static".*"valid": true/m).to_stdout
+  end
+end

data/spec/svg_conform/profiles/svg_2_secure_static_profile_spec.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "SVG 2 secure-static profile" do # rubocop:disable RSpec/DescribeClass
+  let(:profile) { SvgConform::Profiles.get("svg_2_secure_static") }
+  let(:citation) do
+    "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+  end
+  let(:root) { "spec/fixtures/profiles/svg_2_secure_static" }
+
+  def dom_report(path)
+    profile.validate(SvgConform::Document.from_file(path))
+  end
+
+  def sax_report(path)
+    SvgConform::SaxDocument.from_file(path).validate_with_profile(profile)
+  end
+
+  def summary(result)
+    result.errors.map do |e|
+      [e.requirement_id, e.data[:citation]]
+    end.sort
+  end
+
+  it "is discoverable, opt-in and dated" do
+    expect(SvgConform::Profiles.list).to include("svg_2_secure_static")
+    expect(profile.specification_uri).to include("CR-SVG2-20261006")
+    default = SvgConform::Cli.commands["check"].options[:profile].default
+    expect(default).to eq("svg_1_2_rfc")
+  end
+
+  it "defines the four stable requirement ids with the dated citation" do
+    categories = profile.requirements.first.categories
+    ids = categories.map(&:id) + [profile.requirements.last.id]
+    expect(ids).to eq(%w[svg2.secure_static.script svg2.secure_static.animation
+                         svg2.secure_static.interaction
+                         svg2.secure_static.external_reference])
+    expect(categories.map(&:citation).uniq).to eq([citation])
+    expect(profile.requirements.last.citation_uri).to eq(citation)
+  end
+
+  it "uses the unchanged Card 03 requirement class and shape" do
+    expect(profile.requirements.first)
+      .to be_a(SvgConform::Requirements::ProcessingFeaturesRequirement)
+    expect(profile.requirements.first.categories.first.class.attributes.keys)
+      .to eq(%i[name id citation description elements attributes
+                attribute_patterns])
+  end
+
+  Dir.glob("spec/fixtures/profiles/svg_2_secure_static/valid/*.svg").each do |path|
+    it "accepts #{File.basename(path)} through DOM and SAX" do
+      expect(dom_report(path).errors).to be_empty
+      expect(sax_report(path).errors).to be_empty
+    end
+  end
+
+  {
+    "script" => "svg2.secure_static.script",
+    "animation" => "svg2.secure_static.animation",
+    "interaction" => "svg2.secure_static.interaction",
+  }.each do |name, id|
+    it "rejects #{name}.svg only with #{id}, matching DOM and SAX" do
+      path = "#{root}/invalid/#{name}.svg"
+      expect(dom_report(path).errors.map(&:requirement_id).uniq).to eq([id])
+      expect(summary(sax_report(path))).to eq(summary(dom_report(path)))
+      expect(summary(sax_report(path)).first.last).to eq(citation)
+    end
+  end
+
+  def self.external_fixtures
+    Dir.glob("spec/fixtures/profiles/svg_2_secure_static/invalid/*.svg")
+      .map { |f| File.basename(f, ".svg") } - %w[script animation interaction]
+  end
+
+  it "enumerates the external-reference corpus" do
+    expect(self.class.external_fixtures.size).to eq(18)
+  end
+
+  external_fixtures.each do |name|
+    it "rejects #{name}.svg with external_reference, matching DOM and SAX" do
+      path = "#{root}/invalid/#{name}.svg"
+      expect(dom_report(path).errors.map(&:requirement_id).uniq)
+        .to eq(["svg2.secure_static.external_reference"])
+      expect(summary(sax_report(path))).to eq(summary(dom_report(path)))
+      expect(dom_report(path).errors.first.data[:citation]).to eq(citation)
+    end
+  end
+
+  it "emits a LensCore report with the profile citation" do
+    report = SvgConform::Diagnostics::LensCoreAdapter.call(
+      sax_report("#{root}/invalid/http.svg"),
+    )
+    expect(report.valid).to be false
+    expect(report.profile.id).to eq("svg_2_secure_static")
+  end
+
+  def inline_ids(body)
+    xml = %(<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1 1">#{body}</svg>)
+    dom = profile.validate(SvgConform::Document.from_content(xml)).errors
+    sax = SvgConform::SaxDocument.from_content(xml)
+      .validate_with_profile(profile).errors
+    expect(sax.map(&:requirement_id)).to eq(dom.map(&:requirement_id))
+    dom.map(&:requirement_id)
+  end
+
+  {
+    "unlisted pointer handler" => ['<rect onpointerdown="x()"/>',
+                                   %w[svg2.secure_static.interaction]],
+    "unlisted drag handler" => ['<rect ondragstart="x()"/>',
+                                %w[svg2.secure_static.interaction]],
+    "listed load handler keeps script id" => ['<rect onload="x()"/>',
+                                              %w[svg2.secure_static.script]],
+    "listed click handler is reported once" => ['<rect onclick="x()"/>',
+                                                %w[svg2.secure_static.interaction]],
+    "listed begin handler keeps animation id" => ['<rect onbegin="x()"/>',
+                                                  %w[svg2.secure_static.animation]],
+    "style attribute animation" => ['<rect style="animation: pulse 1s infinite"/>',
+                                    %w[svg2.secure_static.animation]],
+    "style attribute vendor transition" => ['<rect style="fill:red;-webkit-transition: all 1s"/>',
+                                            %w[svg2.secure_static.animation]],
+    "style attribute escaped animation" => ['<rect style="\\61nimation-name: pulse"/>',
+                                            %w[svg2.secure_static.animation]],
+    "style element animation" => ["<style>rect { animation: pulse 1s }</style>",
+                                  %w[svg2.secure_static.animation]],
+    "style element keyframes" => ["<style>@keyframes pulse { from { opacity: 0 } }</style>",
+                                  %w[svg2.secure_static.animation]],
+    "style element nested media animation" => ["<style>@media print { a { transition: all 1s } }</style>",
+                                               %w[svg2.secure_static.animation]],
+    "static css is accepted" => ['<style>rect { fill: red } a:hover { fill: blue }</style><rect style="fill: red"/>', []],
+    "animation word in selector or value is accepted" => ['<style>.animation { fill: red }</style><rect style="font-family: animation"/>', []],
+  }.each do |label, (body, expected)|
+    it "#{label}: #{expected.inspect} through DOM and SAX" do
+      expect(inline_ids(body)).to eq(expected)
+    end
+  end
+
+  it "reports external CSS references hidden by escapes through DOM and SAX" do
+    bodies = [
+      '<rect style="fill:u\\72l(https://example.com/x.png)"/>',
+      '<rect style="fill:\\75rl(https://example.com/x.png)"/>',
+      '<style>@\\69mport "https://example.com/a.css";</style>',
+      '<style>@IMP\\4frt url(https://example.com/a.css);</style>',
+    ]
+    bodies.each do |body|
+      expect(inline_ids(body)).to eq(["svg2.secure_static.external_reference"]),
+                                  body
+    end
+  end
+end

data/spec/svg_conform/profiles_plantuml_spec.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "nokogiri"
+
+RSpec.describe SvgConform::Profiles do
+  let(:validator) { SvgConform::Validator.new(mode: :sax) }
+  let(:profile) { described_class.get(:metanorma) }
+  let(:plantuml_attributes) { %w[contentstyletype zoomandpan title textlength lengthadjust] }
+  let(:svg) do
+    <<~SVG
+      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
+           version="1.2" baseProfile="tiny" viewBox="0 0 120 30"
+           contentStyleType="text/css" zoomAndPan="magnify">
+        <a xlink:href="https://example.test/UnitType" title="UnitType">
+          <text id="label" x="0" y="12" textLength="100" lengthAdjust="spacing">UnitType</text>
+        </a>
+      </svg>
+    SVG
+  end
+
+  it "accepts the five explicit layout and link attributes" do
+    result = validator.validate(svg, profile: profile)
+    expect(result.errors.map(&:message)).to be_empty
+  end
+
+  %w[svg text a].each do |element|
+    it "still rejects unrelated attributes on #{element}" do
+      invalid = svg.sub("<#{element} ", "<#{element} unsupported-plantuml-setting=\"no\" ")
+      result = validator.validate(invalid, profile: profile)
+      expect(result.errors.map(&:message).join).to include("unsupported-plantuml-setting")
+    end
+  end
+
+  { "svg" => "textLength", "text" => "zoomAndPan", "a" => "lengthAdjust" }.each do |element, attribute|
+    it "rejects #{attribute} on #{element}" do
+      invalid = svg.sub("<#{element} ", "<#{element} #{attribute}=\"1\" ")
+      result = validator.validate(invalid, profile: profile)
+      expect(result.errors.map(&:message).join.downcase).to include("attribute '#{attribute.downcase}' is not allowed")
+    end
+  end
+
+  %i[svg_1_2_rfc svg_1_2_rfc_with_rdf].each do |strict_profile|
+    it "keeps #{strict_profile} attribute restrictions unchanged" do
+      result = validator.validate(svg, profile: strict_profile)
+      messages = result.errors.map(&:message).join.downcase
+      plantuml_attributes.each do |attribute|
+        expect(messages).to include("attribute '#{attribute}' is not allowed")
+      end
+    end
+  end
+
+  it "preserves native PlantUML text measurements and links during remediation" do
+    source = File.read("spec/fixtures/plantuml/unit-type.svg")
+    document = SvgConform::Document.from_content(source)
+    result = validator.validate(source, profile: profile)
+    SvgConform::RemediationEngine.new(profile).apply_remediations(document, result)
+    output = document.root.to_xml
+    errors = validator.validate(output, profile: profile).errors
+      .reject { |error| error.violation_type == :reference_violation }
+
+    # The fixture's fragment targets belong to the surrounding HTML document.
+    expect(errors.map(&:message)).to be_empty
+    expect(text_layout(output)).to eq(text_layout(source))
+    expect(text_layout(output).size).to eq(28)
+    expect(diagram_links(output)).to eq(diagram_links(source))
+    expect(diagram_links(output).size).to eq(12)
+  end
+
+  def text_layout(xml)
+    Nokogiri::XML(xml).xpath("//svg:text", "svg" => "http://www.w3.org/2000/svg").map do |node|
+      [node.text, node["x"], node["y"], node["textLength"], node["lengthAdjust"]]
+    end
+  end
+
+  def diagram_links(xml)
+    Nokogiri::XML(xml).xpath("//svg:a", "svg" => "http://www.w3.org/2000/svg").map do |node|
+      [node["title"], node.attribute_with_ns("href", "http://www.w3.org/1999/xlink")&.value]
+    end
+  end
+end

data/spec/svg_conform/quality_metrics/configuration_spec.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "svg_conform/quality_metrics/configuration"
+require "psych"
+require "tempfile"
+
+RSpec.describe SvgConform::QualityMetrics::Configuration do
+  describe ".default" do
+    let(:hash) { described_class.default.instance_variable_get(:@hash) }
+
+    it "loads bundled violation types as Symbols" do
+      types = hash.fetch("severity_levels").values.flat_map do |level|
+        level.fetch("violation_types")
+      end
+
+      expect(types).to include(:reference_violation)
+      expect(types).to all(be_a(Symbol))
+    end
+
+    it "preserves the entire Psych-loaded configuration" do
+      expected = Psych.safe_load_file(described_class::DEFAULT_CONFIG_PATH,
+                                      permitted_classes: [Symbol],
+                                      permitted_symbols: [], aliases: true)
+
+      expect(hash).to eq(expected)
+    end
+  end
+
+  describe ".from_yaml" do
+    def load_yaml(source)
+      Tempfile.create(["quality_metrics", ".yml"]) do |file|
+        file.write(source)
+        file.flush
+        described_class.from_yaml(file.path)
+      end
+    end
+
+    it "preserves quoted Symbol values" do
+      pending "yeptris differs from Psych: quoted Symbols retain quotes; upstream issue to be filed, see PR description"
+
+      config = load_yaml('a: :"x y"')
+
+      expect(config.instance_variable_get(:@hash)).to eq("a" => :"x y")
+    end
+
+    it "rejects disallowed dates with the yeptris error naming Date" do
+      expect { load_yaml("f: 2024-01-02\n") }
+        .to raise_error(Yeptris::Psych::DisallowedClass, /Date/)
+    end
+
+    it "rejects disallowed times with the yeptris error naming Time" do
+      pending "yeptris differs from Psych: disallowed Time is reported as Date; upstream issue to be filed, see PR description"
+
+      expect { load_yaml("f: 2024-01-02 10:00:00\n") }
+        .to raise_error(Yeptris::Psych::DisallowedClass, /Time/)
+    end
+
+    it "rejects invalid YAML with the yeptris syntax error" do
+      expect { load_yaml("a: [\n") }.to raise_error(Yeptris::Psych::SyntaxError)
+    end
+
+    it "resolves anchors and aliases" do
+      path = File.expand_path("../../fixtures/quality_metrics/aliases.yml", __dir__)
+      hash = described_class.from_yaml(path).instance_variable_get(:@hash)
+
+      expect(hash.fetch("remediable_types")).to eq([:reference_violation])
+      expect(hash.dig("severity_levels", "critical", "violation_types"))
+        .to eq(hash.fetch("remediable_types"))
+    end
+
+    it "rejects a non-permitted class with the yeptris error" do
+      Tempfile.create(["quality_metrics", ".yml"]) do |file|
+        file.write("--- !ruby/object:Object {}\n")
+        file.flush
+
+        expect { described_class.from_yaml(file.path) }
+          .to raise_error(Yeptris::Psych::DisallowedClass)
+      end
+    end
+  end
+end

data/spec/svg_conform/references/data_uri_reference_spec.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "base64"
+require "zlib"
+
+RSpec.describe SvgConform::References::DataUriReference do
+  def ref(value)
+    SvgConform::References::ReferenceClassifier.classify(
+      value, element_name: "image", attribute_name: "href"
+    )
+  end
+
+  def chunk(type, data)
+    [data.bytesize].pack("N") + type + data + [Zlib.crc32(type + data)].pack("N")
+  end
+
+  let(:png) do
+    "\x89PNG\r\n\x1A\n".b +
+      chunk("IHDR", [1, 1, 8, 2, 0, 0, 0].pack("NNCCCCC")) +
+      chunk("IDAT", Zlib::Deflate.deflate("\x00\xFF\x00\x00".b)) +
+      chunk("IEND", "")
+  end
+  let(:jpeg) { "\xFF\xD8\xFF\xE0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xFF\xD9".b }
+
+  it "decodes base64 and percent-encoded payloads to the same bytes" do
+    pct = png.each_byte.map { |b| format("%%%02X", b) }.join
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(png)}").payload)
+      .to eq(png)
+    expect(ref("data:image/png,#{pct}").payload).to eq(png)
+  end
+
+  it "reports base64? and a normalized media type" do
+    r = ref("data:IMAGE/PNG;base64,AAAA")
+    expect(r.base64?).to be true
+    expect(r.normalized_media_type).to eq("image/png")
+    expect(ref("data:,hello").normalized_media_type).to eq("text/plain")
+  end
+
+  it "accepts well-formed PNG and JPEG payloads" do
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(png)}")
+      .raster_error).to be_nil
+    expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(jpeg)}")
+      .raster_error).to be_nil
+  end
+
+  {
+    "data:image/png;base64," => /empty/,
+    "data:image/png;base64,!!!" => /malformed base64/,
+    "data:image/png,%G1" => /percent/,
+    "data:image/png" => /separator/,
+    "data:image/png;base64,bm90IGEgcG5n" => /not a PNG/,
+    "data:image/jpeg;base64,bm90IGEganBn" => /not a JPEG/,
+  }.each do |value, pattern|
+    it "rejects #{value}" do
+      expect(ref(value).raster_error).to match(pattern)
+    end
+  end
+
+  {
+    "APP0 declaring more bytes than present" => "\xFF\xD8\xFF\xE0\x00\x10\xFF\xD9",
+    "segment length below two" => "\xFF\xD8\xFF\xE0\x00\x01\xFF\xD9",
+    "marker without length" => "\xFF\xD8\xFF",
+    "stray non-marker byte" => "\xFF\xD8\xFF\xE0\x00\x02\x41\xFF\xD9",
+    "end marker inside the data before the end" => "\xFF\xD8\xFF\xD9\x00\x00",
+    "no end of image" => "\xFF\xD8\xFF\xE0\x00\x02",
+    "SOS scan without end of image" => "\xFF\xD8\xFF\xDA\x00\x02\x01\x02\x03",
+  }.each do |label, bytes|
+    it "rejects a malformed JPEG (#{label}) in base64 and percent forms" do
+      raw = bytes.b
+      pct = raw.each_byte.map { |b| format("%%%02X", b) }.join
+      expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(raw)}").raster_error)
+        .to include("JPEG")
+      expect(ref("data:image/jpeg,#{pct}").raster_error).to include("JPEG")
+    end
+  end
+
+  it "accepts a JPEG with a scan, byte stuffing and restart markers" do
+    scan = "\xFF\xD8\xFF\xE0\x00\x04\x00\x00\xFF\xDA\x00\x04\x01\x02\x11\xFF\x00\x22\xFF\xD0\x33\xFF\xD9".b
+    expect(ref("data:image/jpeg;base64,#{Base64.strict_encode64(scan)}").raster_error)
+      .to be_nil
+  end
+
+  it "detects PNG checksum corruption and truncation" do
+    bad = png.dup
+    bad.setbyte(20, bad.getbyte(20) ^ 0xFF)
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(bad)}")
+      .raster_error).to match(/checksum|IHDR/)
+    cut = png.byteslice(0, png.bytesize - 6)
+    expect(ref("data:image/png;base64,#{Base64.strict_encode64(cut)}")
+      .raster_error).not_to be_nil
+  end
+
+  it "stays internal in validation_scope" do
+    expect(ref("data:image/png,x").validation_scope).to eq(:internal)
+  end
+end

data/spec/svg_conform/references/integration_spec.rb

@@ -203,4 +203,34 @@ RSpec.describe "Reference Manifest Integration" do
       expect(manifest_data).to have_key(:statistics)
     end
   end
+
+  describe "secure-static profile shares the classifier" do
+    it "registers the same reference types the link requirement sees" do
+      svg = <<~SVG
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
+          <rect id="a" width="1" height="1"/>
+          <use href="#a"/>
+          <use href="other.svg#a"/>
+        </svg>
+      SVG
+      profile = SvgConform::Profile.new(
+        name: "both",
+        requirements: [
+          SvgConform::Requirements::LinkValidationRequirement.new(id: "link"),
+          SvgConform::Requirements::ExternalReferencesRequirement.new(
+            id: "svg2.secure_static.external_reference",
+          ),
+        ],
+      )
+      result = SvgConform::SaxDocument.from_content(svg)
+        .validate_with_profile(profile)
+      manifest = result.reference_manifest.to_h
+      types = (manifest[:internal_references] + manifest[:external_references])
+        .map { |r| r[:type] }
+      expect(types).to contain_exactly("InternalFragmentReference",
+                                       "RelativePathReference")
+      expect(result.errors.map(&:requirement_id))
+        .to include("svg2.secure_static.external_reference")
+    end
+  end
 end

data/spec/svg_conform/references/reference_classifier_spec.rb

@@ -138,5 +138,22 @@ RSpec.describe SvgConform::References::ReferenceClassifier do
       expect(ref.line_number).to eq(42)
       expect(ref.column_number).to eq(15)
     end
+
+    it "keeps typed returns and the classify signature for secure-static inputs" do
+      expect(described_class.method(:classify).parameters).to eq(
+        [%i[req href_value], %i[keyreq element_name], %i[keyreq attribute_name],
+         %i[key line_number], %i[key column_number]],
+      )
+      {
+        "//example.com/a.png" => SvgConform::References::RelativePathReference,
+        "other.svg#id" => SvgConform::References::RelativePathReference,
+        "file:///etc/passwd#id" => SvgConform::References::RelativePathReference,
+        "DATA:image/png,x" => SvgConform::References::DataUriReference,
+      }.each do |value, klass|
+        ref = described_class.classify(value, element_name: "use",
+                                              attribute_name: "href")
+        expect(ref).to be_a(klass), value
+      end
+    end
   end
 end