Closed Bug 652243 Opened 13 years ago Closed 8 years ago

innerHTML does not close <svg:image> tags properly

Categories

(Core :: DOM: Serializers, defect)

x86
Windows 7
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: a, Unassigned)

References

Details

DOM innerHTML property does not close <image> tags in SVG. This is likely an oversight. <html:image> tag does not require closing tag, <svg:image> does.

If you serialize this:

<div id="#serializeThis">
<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
<image xlink:href="/images/one.png" x="10" y="10"></image>
<image xlink:href="/images/two.png" y="200" x="10"></image>
</svg>
</div>

$("#serializeThis").innerHTML

You'll end up with this invalid HTML:

<div id="#serializeThis">
<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
<image xlink:href="/images/one.png" x="10" y="10">
<image xlink:href="/images/two.png" y="200" x="10">
</svg>
</div>

Notice the missing closing image tags. This will not render properly.
Not sure which component this bug should belong to, but if there was an "HTML: Serializer" component I'd move it there.
Component: SVG → DOM: Core & HTML
QA Contact: general → general
The entire serialization of svg:image tag is busted. Not only does it not close the tag, but it also replaces xlink:href attribute with src attribute.
> Not sure which component this bug should belong to

"Serializers".

The problem is presumably that the HTML serializer assumes this is an <html:image> it's looking at.

Henri, does your patch that I reviewed recently fix this case?  I would think it does.
Component: DOM: Core & HTML → Serializers
QA Contact: general → dom-to-text
Uh, the HTML image tag name is <img>, not <image>.
Alex, the serializer asks the parser service whether a tag is a container.  If it's not, it doesn't serialize an end tag for it.

And when _parsing_ html, <image> is treated as an alias for <img>.  See http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody and search for "image".
But this image is inside SVG, so it is an SVGImageElement, not HTMLImageElement.
svg:image tag wants to be a container. When I recreate the svg by assigning the innerHTML, images nest.
 HTMLImageElement.

Briefly, if x is a div containinig svg images (like my simple example)
a = x.innerHTML
x.innerHTML = a
will hide all the images, because SVG images do not have closing tags. Manually adding closing tags (I am coding this right now), fixes it.

On a side note, whomever designed SVG DOM with attributes & tags that have same names as corresponding HTML tags, yet different behavior, is an idiot.
OS: Mac OS X → Windows 7
> But this image is inside SVG, so it is an SVGImageElement

Yes, but the serializer passes the string localName of the element to the parser, ignoring namespaces.  That's the cause of this bug.

I finally dug up Henri's patch and checked; it should fix this bug.  Marking a dependency accordingly.
Depends on: CVE-2011-2369
(In reply to Boris Zbarsky [:bz] (still a bit busy) from comment #7)
> I finally dug up Henri's patch and checked; it should fix this bug.

The example given in comment 0 does have closing tags now (just tried it in today's nightly), so I guess that Henri's patch ended up doing the trick.
Flags: needinfo?(bzbarsky)
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(bzbarsky)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.