svg_conform 0.2.4 → 0.2.7

data/spec/svg_conform/requirements/external_references_requirement_spec.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "base64"
+
+RSpec.describe SvgConform::Requirements::ExternalReferencesRequirement do
+  let(:requirement) do
+    described_class.new(id: "ext", citation_uri: "https://example.test/cite")
+  end
+  let(:profile) { SvgConform::Profile.new(name: "x", requirements: [requirement]) }
+  let(:ns) { 'xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"' }
+
+  def svg(body, pre: "")
+    %(#{pre}<svg #{ns} viewBox="0 0 1 1">#{body}</svg>)
+  end
+
+  def dom(xml)
+    profile.validate(SvgConform::Document.from_content(xml))
+  end
+
+  def sax(xml)
+    SvgConform::SaxDocument.from_content(xml).validate_with_profile(profile)
+  end
+
+  def b64_svg(inner)
+    "data:image/svg+xml;base64,#{Base64.strict_encode64(inner)}"
+  end
+
+  {
+    "same-document href" => ['<use href="#a"/>', 0],
+    "same-document xlink:href" => ['<use xlink:href="#a"/>', 0],
+    "http href" => ['<image href="http://e.test/a.png"/>', 1],
+    "xlink http href" => ['<image xlink:href="https://e.test/a.png"/>', 1],
+    "anchor to web" => ['<a href="https://e.test/">x</a>', 1],
+    "presentation url" => ['<rect fill="url(other.svg#g)"/>', 1],
+    "presentation fragment" => ['<rect fill="url(#g)"/>', 0],
+    "style attribute url" => ['<rect style="fill:url(&quot;x.svg#g&quot;)"/>', 1],
+    "style element import string" => ['<style>@import "a.css";</style>', 1],
+    "style element import url counted once" => ["<style>@import url(a.css);</style>", 1],
+    "style element url" => ["<style>a{fill:url(a.svg#x)}</style>", 1],
+    "css comment ignored" => ["<style>/* url(a.svg) */ a{fill:red}</style>", 0],
+    "escaped url function" => ['<rect style="fill:u\\72l(https://e.test/x.png)"/>', 1],
+    "escaped url function uppercase hex" => ['<rect style="fill:\\55RL(https://e.test/x.png)"/>', 1],
+    "escaped url in presentation attribute" => ['<rect fill="u\\72l(https://e.test/x.png)"/>', 1],
+    "escaped url with quoted string" => ['<rect style="fill:u\\72l(\'https://e.test/x.png\')"/>', 1],
+    "escaped characters inside the url" => ['<rect style="fill:url(\\68ttps://e.test/x.png)"/>', 1],
+    "escaped import string" => ['<style>@\\69mport "a.css";</style>', 1],
+    "escaped import url" => ['<style>@imp\\6frt url(a.css);</style>', 1],
+    "escaped import with escaped url" => ['<style>@\\69mport u\\72l(a.css);</style>', 1],
+    "url text inside a css string is not a reference" => ['<style>a{content:"url(a.svg)"}</style>', 0],
+    "escaped url with same-document fragment" => ['<rect style="fill:u\\72l(#g)"/>', 0],
+    "javascript scheme" => ['<a href="javascript:x()">x</a>', 1],
+  }.each do |label, (body, count)|
+    it "#{label}: #{count} finding(s) through DOM and SAX" do
+      xml = svg(body)
+      expect(dom(xml).errors.size).to eq(count)
+      expect(sax(xml).errors.map(&:message)).to eq(dom(xml).errors.map(&:message))
+    end
+  end
+
+  it "reports xml-stylesheet processing instructions from the source" do
+    xml = svg("", pre: %(<?xml-stylesheet href="a.css"?>))
+    expect(dom(xml).errors.size).to eq(1)
+    expect(sax(xml).errors.size).to eq(1)
+  end
+
+  it "uses the requirement id and citation in error data" do
+    error = sax(svg('<image href="//e.test/a.png"/>')).errors.first
+    expect(error.requirement_id).to eq("ext")
+    expect(error.data).to include(citation: "https://example.test/cite",
+                                  reference_type: "RelativePathReference")
+  end
+
+  describe "nested SVG data URLs" do
+    let(:plain) { '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>' }
+
+    it "accepts a self-contained SVG" do
+      expect(sax(svg(%(<image href="#{b64_svg(plain)}"/>))).errors).to be_empty
+    end
+
+    it "rejects malformed XML, non-svg roots and external entities" do
+      ["<svg><g></svg>", "<html/>",
+       %(<!DOCTYPE svg SYSTEM "http://e.test/x.dtd"><svg/>)].each do |bad|
+        errors = sax(svg(%(<image href="#{b64_svg(bad)}"/>))).errors
+        expect(errors.size).to eq(1), bad
+      end
+    end
+
+    it "reports nested external content with a JSON-safe reason" do
+      inner = '<svg xmlns="http://www.w3.org/2000/svg"><image href="http://e.test/a"/></svg>'
+      error = dom(svg(%(<image href="#{b64_svg(inner)}"/>))).errors.first
+      expect(error.data[:reason]).to match(/nested href 'http:\/\/e.test\/a'/)
+      expect { JSON.generate(error.data) }.not_to raise_error
+    end
+
+    it "limits nesting depth" do
+      nest = plain
+      4.times do
+        nest = %(<svg xmlns="http://www.w3.org/2000/svg"><image href="#{b64_svg(nest)}"/></svg>)
+      end
+      error = sax(svg(%(<image href="#{b64_svg(nest)}"/>))).errors.first
+      expect(error.data[:reason]).to include("nesting exceeds 3")
+    end
+  end
+
+  it "ignores empty references like the classifier does" do
+    expect(sax(svg('<image href=""/>')).errors).to be_empty
+  end
+end

data/spec/svg_conform/requirements/link_validation_requirement_spec.rb

@@ -74,4 +74,20 @@ RSpec.describe SvgConform::Requirements::LinkValidationRequirement do
       expect(requirement).to be_a(described_class)
     end
   end
+
+  describe "classifier sharing with ExternalReferencesRequirement" do
+    it "still reports a missing fragment target while external-reference allows the fragment" do
+      svg = '<svg xmlns="http://www.w3.org/2000/svg"><use href="#missing"/></svg>'
+      profile = SvgConform::Profile.new(
+        name: "p",
+        requirements: [
+          described_class.new(id: "link"),
+          SvgConform::Requirements::ExternalReferencesRequirement.new(id: "ext"),
+        ],
+      )
+      ids = SvgConform::SaxDocument.from_content(svg)
+        .validate_with_profile(profile).errors.map(&:requirement_id)
+      expect(ids).not_to include("ext")
+    end
+  end
 end

data/spec/svg_conform/requirements/processing_features_requirement_spec.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "yaml"
+
+RSpec.describe SvgConform::Requirements::ProcessingFeaturesRequirement do
+  let(:config_path) { "config/requirements/processing_features_static.yml" }
+  let(:requirement) { described_class.from_yaml(File.read(config_path)) }
+  let(:profile) do
+    SvgConform::Profile.new(name: "pf", requirements: [requirement])
+  end
+  let(:svg_ns) { 'xmlns="http://www.w3.org/2000/svg"' }
+
+  def svg(body)
+    %(<svg #{svg_ns} version="1.1" viewBox="0 0 10 10">#{body}</svg>)
+  end
+
+  def dom_ids(xml)
+    profile.validate(SvgConform::Document.from_content(xml))
+      .errors.map(&:requirement_id).sort
+  end
+
+  def sax_ids(xml)
+    SvgConform::SaxDocument.from_content(xml).validate_with_profile(profile)
+      .errors.map(&:requirement_id).sort
+  end
+
+  it "loads the three categories from YAML with separate ids and citations" do
+    expect(requirement.categories.map(&:name))
+      .to eq(%w[script animation interaction])
+    expect(requirement.categories.map(&:id)).to eq(
+      %w[svg11.processing.script svg11.processing.animation
+         svg11.processing.interaction],
+    )
+    expect(requirement.categories.map(&:citation).uniq.size).to eq(1)
+  end
+
+  it "resolves through a profile YAML via the requirement class map" do
+    entry = File.read(config_path).lines.each_with_index.map do |l, i|
+      i.zero? ? "  - #{l}" : "    #{l}"
+    end.join
+    yaml = "name: x\nrequirements:\n#{entry}"
+    loaded = SvgConform::Profile.from_yaml(yaml)
+    expect(loaded.requirements.first).to be_a(described_class)
+  end
+
+  it "is registered in Requirements.all" do
+    expect(SvgConform::Requirements.all).to include(described_class)
+  end
+
+  {
+    "script element" => ["<script>x()</script>", %w[svg11.processing.script]],
+    "load handler" => ['<rect onload="x()" width="1" height="1"/>',
+                       %w[svg11.processing.script]],
+    "animate element" => ['<rect width="1" height="1"><animate attributeName="x" dur="1s"/></rect>',
+                          %w[svg11.processing.animation svg11.processing.animation]],
+    "click handler" => ['<rect onclick="x()" width="1" height="1"/>',
+                        %w[svg11.processing.interaction]],
+    "cursor attribute" => ['<rect cursor="pointer" width="1" height="1"/>',
+                           %w[svg11.processing.interaction]],
+    "clean static" => ['<rect width="1" height="1"/>', []],
+  }.each do |label, (body, expected)|
+    it "reports #{label} identically through DOM and SAX" do
+      xml = svg(body)
+      expect(dom_ids(xml)).to eq(expected)
+      expect(sax_ids(xml)).to eq(expected)
+    end
+  end
+
+  it "attaches the category citation to the error" do
+    error = SvgConform::SaxDocument.from_content(svg("<script/>"))
+      .validate_with_profile(profile).errors.first
+    expect(error.data[:citation]).to eq(requirement.categories.first.citation)
+  end
+end

data/spec/svg_conform/requirements/svg_1_1_document_requirement_spec.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe SvgConform::Requirements::Svg11DocumentRequirement do # rubocop:disable RSpec/SpecFilePathFormat
+  let(:svg_ns) { 'xmlns="http://www.w3.org/2000/svg"' }
+  let(:profile_path) { "config/profiles/svg_1_1_full_static.yml" }
+
+  def requirement_for(rule)
+    SvgConform::Profile.load_from_file(profile_path).requirements.find do |req|
+      req.respond_to?(:rule) && req.rule == rule
+    end
+  end
+
+  def run(rule, xml, mode: :sax, serialized: false)
+    requirement = requirement_for(rule)
+    profile = SvgConform::Profile.new(name: "t", requirements: [requirement])
+    if mode == :dom
+      profile.validate(SvgConform::Document.from_content(xml)).errors
+    else
+      SvgConform::SaxDocument.from_content(xml, source_serialized: serialized)
+        .validate_with_profile(profile).errors
+    end
+  end
+
+  def doc(attrs: 'version="1.1"', body: '<rect width="1" height="1"/>', prolog: "")
+    %(<?xml version="1.0"?>\n#{prolog}<svg #{svg_ns} #{attrs}>#{body}</svg>)
+  end
+
+  it "defines one entry per matrix row with its own id and citation" do
+    entries = SvgConform::Profile.load_from_file(profile_path).requirements
+      .grep(described_class)
+    expect(entries.map(&:rule)).to eq(described_class::RULES)
+    expect(entries.map(&:id)).to eq(
+      %w[svg11.document.xml svg11.document.root svg11.document.version
+         svg11.document.grammar svg11.document.css2
+         svg11.document.xml_stylesheet],
+    )
+    expect(entries.map(&:citation_uri)).to all(start_with("https://www.w3.org/TR/"))
+  end
+
+  it "is registered in Requirements.all" do
+    expect(SvgConform::Requirements.all).to include(described_class)
+  end
+
+  it "rejects an unknown rule" do
+    requirement = described_class.new(id: "x", rule: "nope")
+    context = SvgConform::ValidationContext.new(nil, nil, source: "<svg/>")
+    expect { requirement.validate_source("<svg/>", context) }
+      .to raise_error(ArgumentError, /unknown rule/)
+  end
+
+  %i[sax dom].each do |mode|
+    context "when validating in #{mode} mode" do
+      it "accepts a valid document in every rule" do
+        described_class::RULES.each do |rule|
+          expect(run(rule, doc, mode: mode)).to be_empty, "rule #{rule}"
+        end
+      end
+
+      it "flags a wrong root namespace" do
+        errors = run("root", doc.sub(svg_ns, 'xmlns="http://example.com/x"'), mode: mode)
+        expect(errors.map(&:requirement_id)).to eq(["svg11.document.root"])
+      end
+
+      it "flags a wrong or missing version" do
+        expect(run("version", doc(attrs: 'version="1.0"'), mode: mode).size).to eq(1)
+        expect(run("version", doc(attrs: ""), mode: mode).size).to eq(1)
+      end
+
+      it "flags DTD content-model and attribute violations" do
+        model = run("grammar", doc(body: "<rect><g/></rect>"), mode: mode)
+        attribute = run("grammar", doc(body: '<rect width="1" height="1" bogus="1"/>'), mode: mode)
+        expect(model.map(&:requirement_id)).to all(eq("svg11.document.grammar"))
+        expect(model).not_to be_empty
+        expect(attribute).not_to be_empty
+      end
+
+      it "does not follow an external entity" do
+        xml = "<?xml version=\"1.0\"?>\n<!DOCTYPE svg [<!ENTITY x SYSTEM \"file:///etc/passwd\">]>\n<svg #{svg_ns} version=\"1.1\"><title>&x;</title></svg>"
+        errors = run("grammar", xml, mode: mode)
+        expect(errors.map(&:message).join).to include("external")
+        expect(errors.map(&:message).join).not_to include("root:")
+      end
+
+      it "flags CSS grammar errors in style attributes and style elements" do
+        attr = run("css2", doc(body: '<rect width="1" height="1" style="fill: {red"/>'), mode: mode)
+        sheet = run("css2", doc(body: "<style>rect { fill: red </style>"), mode: mode)
+        expect(attr.size).to be >= 1
+        expect(sheet.size).to be >= 1
+      end
+
+      it "accepts valid CSS and skips non-CSS style types" do
+        css = "<style>rect { fill: red }</style><style type=\"text/x-other\">{{</style>"
+        expect(run("css2", doc(body: css), mode: mode)).to be_empty
+      end
+
+      it "treats text/css media types case-insensitively" do
+        upper = run("css2", doc(body: '<style type="TEXT/CSS">rect { fill: red </style>'), mode: mode)
+        mixed = run("css2", doc(body: '<style type="Text/Css">rect { fill: red </style>'), mode: mode)
+        pi = %(<?xml-stylesheet href="a.css" type="TEXT/CSS"?>\n)
+        expect(upper.size).to be >= 1
+        expect(mixed.size).to be >= 1
+        expect(run("xml_stylesheet", doc(prolog: pi), mode: mode)).to be_empty
+      end
+
+      it "validates xml-stylesheet pseudo-attributes" do
+        good = doc(prolog: %(<?xml-stylesheet href="a.css" type="text/css"?>\n))
+        no_href = doc(prolog: %(<?xml-stylesheet type="text/css"?>\n))
+        bad_type = doc(prolog: %(<?xml-stylesheet href="a.xsl" type="text/xsl"?>\n))
+        garbled = doc(prolog: %(<?xml-stylesheet href=a.css?>\n))
+        expect(run("xml_stylesheet", good, mode: mode)).to be_empty
+        [no_href, bad_type, garbled].each do |xml|
+          expect(run("xml_stylesheet", xml, mode: mode).map(&:requirement_id))
+            .to eq(["svg11.document.xml_stylesheet"])
+        end
+      end
+    end
+  end
+
+  it "reports malformed XML through SAX" do
+    errors = run("xml", "<svg #{svg_ns}><rect></svg>")
+    expect(errors.map(&:requirement_id)).to include("svg11.document.xml")
+  end
+
+  it "cannot prove declaration claims for a re-serialized source" do
+    errors = run("xml", doc, serialized: true)
+    expect(errors.map(&:requirement_id)).to eq(["svg11.document.xml"])
+    expect(errors.first.message).to include("cannot be proved")
+    expect(run("xml", doc, serialized: false)).to be_empty
+  end
+
+  it "reports the same through a DOM node and a serialized SAX source" do
+    node = SvgConform::Document.from_content(doc).moxml_document
+    dom = SvgConform::Document.from_node(node)
+    profile = SvgConform::Profile.new(name: "t", requirements: [requirement_for("xml")])
+    expect(profile.validate(dom).errors.map(&:requirement_id))
+      .to eq(["svg11.document.xml"])
+  end
+end

data/spec/svg_conform/requirements/text_as_path_requirement_spec.rb

@@ -56,12 +56,16 @@ RSpec.describe SvgConform::Requirements::TextAsPathRequirement do
       SVG
 
       result = validator.validate(svg, profile: :metanorma)
-      text_as_path_errors = result.errors.select do |e|
-        e.message.include?("rendered as paths")
-      end
 
-      expect(text_as_path_errors).not_to be_empty
-      expect(text_as_path_errors.first.severity).to eq(:warning)
+      # Text-as-path is a quality advisory declared with severity: warning:
+      # it must surface as a warning, never as an error, so that schema-valid
+      # documents are not reported as invalid (metanorma-pdfa#106).
+      expect(result.errors).to be_empty
+      expect(result.warnings.map(&:message)).to include(
+        a_string_including("rendered as paths"),
+      )
+      expect(result.warnings.first.severity).to eq(:warning)
+      expect(result).to be_valid
     end
 
     it "does not flag SVG with native text elements" do

data/spec/svg_conform/validation/css2_core_grammar_spec.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "svg_conform/validation/css2_core_grammar"
+
+RSpec.describe SvgConform::Validation::Css2CoreGrammar do
+  describe ".tokenize" do
+    def types(css)
+      described_class.tokenize(css).map(&:type)
+    end
+
+    it "classifies the CSS 2 token kinds" do
+      css = 'a:hover #id 10 50% 2em url(x.png) rgb( "s" U+0-7F ~= |= @page <!-- -->'
+      expect(types(css).reject { |t| t == :s }).to eq(
+        [:ident, ":", :ident, :hash, :number, :percentage, :dimension, :uri, :function, :string,
+         :unicode_range, :includes, :dashmatch, :atkeyword, :cdo, :cdc],
+      )
+    end
+
+    it "drops comments and tracks line and column" do
+      tokens = described_class.tokenize("a /* c\n */ b")
+      expect(tokens.map(&:value)).to eq(["a", " ", " ", "b"])
+      expect(tokens.last.line).to eq(2)
+      expect(tokens.last.column).to eq(5)
+    end
+
+    it "flags unterminated strings and comments" do
+      expect(types('"abc')).to eq([:bad_string])
+      expect(types("/* abc")).to eq([:bad_comment])
+    end
+
+    it "accepts escapes in identifiers" do
+      expect(types('\66 ill')).to eq([:ident])
+    end
+  end
+
+  describe ".parse_stylesheet" do
+    valid = {
+      "empty sheet" => "",
+      "comments and CDO/CDC" => "<!-- /* x */ a { fill: red } -->",
+      "multiple selectors" => "rect, circle.a > path[x=\"1\"]:first-child { fill: #fff }",
+      "empty declaration slots" => "a { ; fill: red;; stroke: blue; }",
+      "functions and !important" => "a { fill: rgb(1, 2, 3) !important; stroke: url(#g) }",
+      "empty ruleset" => "a { }",
+      "@import" => '@import url("x.css") screen;',
+      "@media with nested rules" => "@media print { a { x: y } b { x: y } }",
+      "@font-face" => '@font-face { font-family: "F"; src: url(f.woff) }',
+      "unknown at-rule block" => "@foo bar { baz { qux: 1 } }",
+      "selector-less ruleset" => "{ fill: red }",
+    }
+
+    valid.each do |name, css|
+      it "accepts #{name}" do
+        expect(described_class.parse_stylesheet(css)).to be_valid
+      end
+    end
+
+    invalid = {
+      "missing colon" => ["a { fill red }", /expected ':'/],
+      "missing value" => ["a { fill: }", /no value/],
+      "missing property" => ["a { : red }", /property name/],
+      "unclosed ruleset" => ["a { fill: red", /missing '}'/],
+      "unclosed string" => ["a { fill: \"red }", /unterminated string/],
+      "unclosed comment" => ["a { fill: red } /* x", /unterminated comment/],
+      "unclosed function" => ["a { fill: rgb(1,2 }", /missing '\)'/],
+      "selector without block" => ["a b", /missing a '\{' block/],
+      "unterminated at-rule" => ["@import url(x.css)", /at-rule/],
+      "stray closing brace" => ["a { fill: red } }", /unexpected '\}'/],
+    }
+
+    invalid.each do |name, (css, message)|
+      it "rejects #{name}" do
+        result = described_class.parse_stylesheet(css)
+        expect(result).not_to be_valid
+        expect(result.errors.map(&:message).join("\n")).to match(message)
+      end
+    end
+
+    it "reports the position of the first error" do
+      error = described_class.parse_stylesheet("a { fill: red }\nb { fill blue }")
+        .errors.first
+      expect(error.line).to eq(2)
+      expect(error.to_s).to include("line 2")
+    end
+  end
+
+  describe ".parse_declarations" do
+    it "accepts a style attribute value" do
+      css = "fill:red; stroke : url(#a) ; stroke-width:2px;"
+      expect(described_class.parse_declarations(css)).to be_valid
+    end
+
+    it "accepts an empty value and stray semicolons" do
+      expect(described_class.parse_declarations("")).to be_valid
+      expect(described_class.parse_declarations(" ; ;")).to be_valid
+    end
+
+    it "rejects a declaration without a colon" do
+      result = described_class.parse_declarations("fill red")
+      expect(result).not_to be_valid
+    end
+
+    it "rejects a stray closing brace in a declaration list" do
+      result = described_class.parse_declarations("fill:red } stroke:blue")
+      expect(result).not_to be_valid
+    end
+
+    it "rejects a ruleset where a declaration list is expected" do
+      expect(described_class.parse_declarations("a { fill: red }")).not_to be_valid
+    end
+
+    it "does not judge property names or values" do
+      expect(described_class.parse_declarations("bogus-prop: nonsense 12qq")).to be_valid
+    end
+  end
+end

data/spec/svg_conform/validation/svg_1_1_document_conformance_spec.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "digest"
+require "yaml"
+require "tmpdir"
+require "svg_conform/validation/svg_1_1_document_conformance"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe SvgConform::Validation::Svg11DocumentConformance do # rubocop:disable RSpec/SpecFilePathFormat
+  subject(:conformance) { described_class.new }
+
+  let(:ns) { %(xmlns="http://www.w3.org/2000/svg" version="1.1") }
+  let(:dtd_path) { described_class::DTD_PATH }
+
+  def svg(body, attrs = ns)
+    %(<?xml version="1.0"?>\n<svg #{attrs}>#{body}</svg>)
+  end
+
+  # Library selection record (card 03, "Open implementation question").
+  # Probes: valid document, invalid content model, external-entity attempt,
+  # Appendix G.2 foreign content, run offline against the vendored flat DTD.
+  #
+  #   Moxml/Leptris 1.9.381 (Leptris::XML::DTD): parses the DTD but ignores
+  #   conditional sections whose keyword is a parameter entity
+  #   (<![%svg-structure.module;[ ... ]]>), so no SVG element is declared and
+  #   every probe, including the invalid ones, reports valid. Rejected.
+  #   Nokogiri 1.19 (libxml2 2.13, Ruby >= 3.1 with 1.16/1.18): all four
+  #   probes behave correctly offline, in-process, with NONET and no entity
+  #   loading. Selected.
+  describe "library probes" do
+    let(:flat_dtd) { File.read(dtd_path) }
+
+    it "records that Leptris cannot enforce the flat DTD" do
+      require "leptris"
+      handle = Leptris::XML::DTD.parse(flat_dtd)
+      invalid = Leptris::XML.parse(%(<svg #{ns}><rect width="1" height="1"><g/></rect></svg>))
+
+      expect(handle.validate(invalid)).to be_empty
+    end
+
+    it "probe 1: Nokogiri accepts a valid document" do
+      expect(conformance.validate(svg(%(<rect width="1" height="1"/>))).issues).to be_empty
+    end
+
+    it "probe 2: Nokogiri rejects an invalid content model" do
+      result = conformance.validate(svg(%(<rect width="1" height="1"><g/></rect>)))
+
+      expect(result.issues.map(&:kind)).to eq([:dtd])
+      expect(result.issues.first.message).to include("rect content does not follow the DTD")
+    end
+
+    it "probe 3: an external entity attempt is rejected without reading the file" do
+      Dir.mktmpdir do |dir|
+        secret = File.join(dir, "secret.txt")
+        File.write(secret, "SECRET-MARKER")
+        source = %(<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY x SYSTEM "file://#{secret}">]>) +
+          %(<svg #{ns}><title>&x;</title></svg>)
+
+        result = conformance.validate(source)
+
+        expect(result.issues.map(&:kind)).to eq([:external_entity])
+        expect(result.transformed).to be_nil
+      end
+    end
+
+    it "probe 4: foreign content validates after the Appendix G.2 transform" do
+      source = svg(%(<f:thing f:a="1"><g/></f:thing><metadata><f:m/></metadata>),
+                   %(#{ns} xmlns:f="urn:foreign"))
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+  end
+
+  describe "#validate" do
+    it "reports a missing required attribute" do
+      result = conformance.validate(svg(%(<rect height="1"/>)))
+
+      expect(result.issues.first.message).to include("Element rect does not carry attribute width")
+    end
+
+    it "reports an undeclared attribute" do
+      result = conformance.validate(svg(%(<rect width="1" height="1" bogus="x"/>)))
+
+      expect(result.issues.first.message).to include("No declaration for attribute bogus")
+    end
+
+    it "reports malformed XML" do
+      result = conformance.validate(svg(%(<rect width="1" height="1">)))
+
+      expect(result.issues.first.kind).to eq(:malformed_xml)
+    end
+
+    it "reports a document element outside the SVG namespace" do
+      result = conformance.validate(%(<svg xmlns="urn:other" version="1.1"/>))
+
+      expect(result.issues.map(&:kind)).to eq([:no_svg_root])
+    end
+
+    it "validates xlink attributes under any prefix" do
+      source = svg(%(<defs><g id="a"/></defs><use xlink:href="#a"/>),
+                   %(#{ns} xmlns:xl="http://www.w3.org/1999/xlink"))
+      source = source.sub("xlink:href", "xl:href")
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "validates prefixed SVG elements" do
+      source = %(<s:svg xmlns:s="http://www.w3.org/2000/svg" version="1.1"><s:rect width="1" height="1"/></s:svg>)
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "expands internal entities before validating" do
+      source = %(<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY w "5">]><svg #{ns}><rect width="&w;" height="1"/></svg>)
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "never modifies the caller's source" do
+      source = svg(%(<f:x xmlns:f="urn:f"/><rect width="1" height="1"/>)).freeze
+
+      expect { conformance.validate(source) }.not_to raise_error
+      expect(source).to include("<f:x")
+    end
+
+    it "keeps the Appendix G.2 copy free of foreign content" do
+      copy = conformance.validate(svg(%(<f:x xmlns:f="urn:f"/>), %(#{ns} f2:a="1" xmlns:f2="urn:f"))).transformed
+
+      expect(copy).not_to include("f:x")
+      expect(copy).not_to include("f2:a")
+      expect(copy).to include(%(xmlns:xlink="http://www.w3.org/1999/xlink"))
+    end
+  end
+
+  describe "vendored DTD" do
+    it "matches the manifest checksum" do
+      entry = YAML.safe_load_file(described_class::MANIFEST_PATH, permitted_classes: [Date])["files"].first
+
+      expect(Digest::SHA256.file(dtd_path).hexdigest).to eq(entry["sha256"])
+      expect(entry["source_url"]).to start_with("https://www.w3.org/")
+    end
+  end
+end