From 25563a8e5b2386449daab7e79169d5b2e983e592 Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Mon, 2 Nov 2026 04:49:55 +0000
Subject: [PATCH] test(review): CSS in a drawing SVG holds only declarations
 and url(#id): image-set(), image(), element() keep it code (GST-911 Step 11,
 failing first)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 test/review-planner-misreads.test.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/test/review-planner-misreads.test.ts b/test/review-planner-misreads.test.ts
index 15bda38b1..4e0f51743 100644
--- a/test/review-planner-misreads.test.ts
+++ b/test/review-planner-misreads.test.ts
@@ -125,7 +125,8 @@ describe('GST-911 misread 1: a chart SVG is data, an SVG that can run code is se
   // Value: protects=only an SVG made of drawing elements is data: anything that loads, links or declares outside that set stays code;
   //   fails_when=an external image or stylesheet, an entity declaration, an animation or a CSS url() to another document reads as docs,
   //   including through a CSS escape or a zero-padded character reference (review pass 1 findings) or behind a stray quote that
-  //   pairs with a later one (review pass 2 finding); seam=collectCommit + depthOfCommitInput
+  //   pairs with a later one (review pass 2 finding), or any CSS beyond declarations and url(#id) (Step 11 finding: image-set());
+  //   seam=collectCommit + depthOfCommitInput
   test.each([
     ['an external image', '  <image href="https://x.test/pixel.png" width="1" height="1"/>'],
     ['a CSS import', '  <style>@import url("https://x.test/a.css");</style>'],
@@ -141,6 +142,13 @@ describe('GST-911 misread 1: a chart SVG is data, an SVG that can run code is se
     ['an external use after a stray quote in a comment', "  <!-- z=' --><use href=\"https://x.test/o.svg#a\"/><!-- ' -->"],
     ['an external xlink:href after a stray quote in a desc', "  <desc>z='</desc><image xlink:href=\"https://x.test/p.png\"/><desc>'</desc>"],
     ['an external image after a stray href in text', "  <text>href='#</text><image href=\"https://x.test/p.png\"/><text>'</text>"],
+    ['a CSS image-set() in a style element', '  <style>rect{fill:image-set("https://x.test/p.png" 1x)}</style>'],
+    ['a CSS image-set() in a style attribute', "  <rect style=\"fill:-webkit-image-set('https://x.test/p.png' 1x)\"/>"],
+    ['a CSS image() with a string', '  <style>rect{fill:image("https://x.test/p.png")}</style>'],
+    ['a CSS element() reference', '  <rect style="fill:element(#m0)"/>'],
+    ['a CSS import of a bare string', '  <style>@import "https://x.test/a.css";</style>'],
+    ['a style element import', '  <style>@import url("https://x.test/a.css");</style>'],
+    ['a style attribute cross-fade()', '  <rect style="fill:cross-fade(url(https://x.test/a.png), url(#m0), 50%)"/>'],
   ])('%s keeps the SVG code', (_name, line) => {
     const fx = fixture();
     expect(plan(fx, fx.commit({ 'results/chart.svg': chart(5, line) })).class).toBe('code');