Thanks for the question! > Will this enable navigation to javaScript: URLs? No. This feature doesn't change the behavior of navigation of the SVG a element. It only adds helper IDL attributes (such as origin, host, etc) which can get or set the specific part of href/xlink:href attributes.
> will these navigations be covered by CSP? Yes, navigating to javaScript: URLs is allowed in SVG a element before this feature. I think SVG already has some CSP WPT coverage for that. E.G. https://github.com/web-platform-tests/wpt/blob/bfb04e06cf7fcf9f4739990b4c0ca252f189840f/sanitizer-api/sanitizer-javascript-url.html#L35 Best, Meng 在2026年8月5日星期三 UTC+8 01:21:18<[email protected]> 写道： > Hi, > > This change has a lot in common with the MathML change described in this > thread > <https://groups.google.com/a/chromium.org/g/blink-dev/c/kmtYoVZjtZE/m/VK7ps7U3AAAJ>. > > Could we please make sure that the security questions on that thread are > also covered for this change? > > In particular, > * Will this enable navigation to javaScript: URLs? > * If so, will these navigations be covered by CSP? It would be best to > have some WPT coverage testing this. > > Thanks, > Mustafa > > On Tuesday, July 28, 2026 at 5:49:05 AM UTC-7 [email protected] wrote: > >> Contact emails >> [email protected] >> >> Specification >> https://github.com/w3c/svgwg/pull/1052 >> >> Summary >> Recently some attributes of HTMLHyperlinkElementUtils have been moved >> into a new HyperlinkElementUtils interface which will be shared by >> HTML/SVG/MathML.[1] >> >> In the spec, the SVG a element should implement >> HTMLHyperlinkElementUtils, but in practice no one was doing that because >> there are attributes that conflict between HTMLHyperlinkElementUtils and >> SVGURIReference. [2] >> >> In this feature we will add attributes like origin, protocol, username, >> password, host, hostname, port, pathname, search and hash to the SVG a >> element by implementing the new HyperlinkElementUtils mixin.[3] >> >> [1] https://chromium-review.googlesource.com/c/chromium/src/+/7899676 >> [2] https://github.com/w3c/svgwg/issues/312 >> [3] https://chromium-review.googlesource.com/c/chromium/src/+/8015702 >> >> Blink component >> Blink>SVG >> >> Web Feature ID >> Missing feature >> >> Motivation >> Recent developments in standards bodies have led to a renewed effort to >> align the various hyperlink elements, this change brings the 'origin', >> 'protocol', 'pathname' etc properties that already exist on HTML and MathML >> <a> to the SVG <a> element. >> >> Initial public proposal >> https://github.com/w3c/svgwg/issues/312 >> >> Goals for experimentation >> None >> >> Requires code in //chrome? >> False >> >> Tracking bug >> https://issues.chromium.org/issues/512726601 >> >> Estimated milestones >> No milestones specified >> >> >> >> Link to entry on the Chrome Platform Status >> https://chromestatus.com/feature/5990570242736128?gate=6408874992205824 >> >> This intent message was generated by Chrome Platform Status. > > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/47c678fb-8234-4496-b73d-8d582a4213b4n%40chromium.org.
