Intent to Prototype: Swap SVGAElement to the new HyperlinkElementUtils

[tannal]

Contact emails
mt...@igalia.com

Specification
https://github.com/w3c/svgwg/pull/1052

Summary
Recently some attributes of HTMLHyperlinkElementUtils have been moved into a new HyperlinkElementUtils interface which will be shared by HTML/SVG/MathML.[1]

In the spec, the SVG a element should implement HTMLHyperlinkElementUtils, but in practice no one was doing that because there are attributes that conflict between HTMLHyperlinkElementUtils and SVGURIReference. [2]

In this feature we will add attributes like origin, protocol, username, password, host, hostname, port, pathname, search and hash to the SVG a element by implementing the new HyperlinkElementUtils mixin.[3]

[1] https://chromium-review.googlesource.com/c/chromium/src/+/7899676
[2] https://github.com/w3c/svgwg/issues/312
[3] https://chromium-review.googlesource.com/c/chromium/src/+/8015702

Blink component
Blink>SVG

Web Feature ID
Missing feature

Motivation
Recent developments in standards bodies have led to a renewed effort to align the various hyperlink elements, this change brings the 'origin', 'protocol', 'pathname' etc properties that already exist on HTML and MathML <a> to the SVG <a> element.

Initial public proposal
https://github.com/w3c/svgwg/issues/312

Goals for experimentation
None

Requires code in //chrome?
False

Tracking bug
https://issues.chromium.org/issues/512726601

Estimated milestones
No milestones specified



Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/5990570242736128?gate=6408874992205824

This intent message was generated by Chrome Platform Status.

[Mustafa Emre Acer]

Hi,

This change has a lot in common with the MathML change described in this thread. Could we please make sure that the security questions on that thread are also covered for this change?

In particular,

* Will this enable navigation to javaScript: URLs?

* If so, will these navigations be covered by CSP? It would be best to have some WPT coverage testing this.

Thanks,

Mustafa

[tannal]

Thanks for the question!

> Will this enable navigation to javaScript: URLs?

No.
This feature doesn't change the behavior of navigation of the SVG a element.
It only adds helper IDL attributes (such as origin, host, etc) which can get or set the specific part of href/xlink:href attributes.

> will these navigations be covered by CSP?

Yes, navigating to javaScript: URLs is allowed in SVG a element before this feature.
I think SVG already has some CSP WPT coverage for that.
E.G. https://github.com/web-platform-tests/wpt/blob/bfb04e06cf7fcf9f4739990b4c0ca252f189840f/sanitizer-api/sanitizer-javascript-url.html#L35

Best,
Meng