From 10af2e1edb11623cacc388c300253f5e4ceef5ec Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Mon, 2 Nov 2026 04:33:26 +0000
Subject: [PATCH] test(review): a stray quote cannot hide an external href in a
 drawing SVG (GST-911 review pass 2, failing first)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 test/review-planner-misreads.test.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/test/review-planner-misreads.test.ts b/test/review-planner-misreads.test.ts
index 2edcf5e72..15bda38b1 100644
--- a/test/review-planner-misreads.test.ts
+++ b/test/review-planner-misreads.test.ts
@@ -124,7 +124,8 @@ describe('GST-911 misread 1: a chart SVG is data, an SVG that can run code is se
 
   // Value: protects=only an SVG made of drawing elements is data: anything that loads, links or declares outside that set stays code;
   //   fails_when=an external image or stylesheet, an entity declaration, an animation or a CSS url() to another document reads as docs,
-  //   including through a CSS escape or a zero-padded character reference (review pass 1 findings); seam=collectCommit + depthOfCommitInput
+  //   including through a CSS escape or a zero-padded character reference (review pass 1 findings) or behind a stray quote that
+  //   pairs with a later one (review pass 2 finding); seam=collectCommit + depthOfCommitInput
   test.each([
     ['an external image', '  <image href="https://x.test/pixel.png" width="1" height="1"/>'],
     ['a CSS import', '  <style>@import url("https://x.test/a.css");</style>'],
@@ -136,6 +137,10 @@ describe('GST-911 misread 1: a chart SVG is data, an SVG that can run code is se
     ['a CSS-escaped url()', '  <rect style="fill: u\\72l(https://x.test/a.svg#g)"/>'],
     ['a zero-padded character reference import', '  <style>@&#0000000000105;mport "https://x.test/a.css";</style>'],
     ['a zero-padded hex character reference url()', '  <rect style="fill: u&#x0000000072;l(https://x.test/a.svg#g)"/>'],
+    ['an external image after a stray quote in text', "  <text>z='</text><image href=\"https://x.test/p.png\"/><text>'</text>"],
+    ['an external use after a stray quote in a comment', "  <!-- z=' --><use href=\"https://x.test/o.svg#a\"/><!-- ' -->"],
+    ['an external xlink:href after a stray quote in a desc', "  <desc>z='</desc><image xlink:href=\"https://x.test/p.png\"/><desc>'</desc>"],
+    ['an external image after a stray href in text', "  <text>href='#</text><image href=\"https://x.test/p.png\"/><text>'</text>"],
   ])('%s keeps the SVG code', (_name, line) => {
     const fx = fixture();
     expect(plan(fx, fx.commit({ 'results/chart.svg': chart(5, line) })).class).toBe('code');