feat: disallow data URLs in the package document

src/main/java/com/adobe/epubcheck/opf/OPFChecker30.java

@@ -85,6 +85,12 @@ protected boolean checkContent()
   @Override
   protected void checkItem(OPFItem item, OPFHandler opfHandler)
   {
+    // Items with `data:` URLs are not allowed in EPUB 3
+    if (item.hasDataURL())
+    {
+      report.message(MessageId.RSC_029, item.getLocation());
+      return;
+    }
     if (item.getPath().startsWith("META-INF/"))
     {
       report.message(MessageId.PKG_025, item.getLocation());
@@ -182,10 +188,9 @@ else if (!overlayTextChecker.isCorrectOverlay(docURL, mo))
   @Override
   protected void checkSpineItem(OPFItem item, OPFHandler opfHandler)
   {
-    // Items with `data:` URLs are not allowed in the spine
+    // Items with `data:` URLs are not allowed and reported earlier
     if (item.hasDataURL())
     {
-      report.message(MessageId.RSC_029, item.getLocation());
       return;
     }
 

src/main/java/com/adobe/epubcheck/opf/OPFHandler30.java

@@ -393,12 +393,17 @@ private void processLink()
   {
     XMLElement e = currentElement();
 
+    // check the 'href' URL
+    // href presence is checked by schema
     String href = e.getAttribute("href");
-    if (href != null)
-    { // href presence is checked by schema
-
-      // check the 'href' URL
-      URL url = checkURL(href);
+    URL url = checkURL(href);
+    if (url != null)
+    {
+      // Data URLs are not allowed on `link` elements
+      if ("data".equals(url.scheme())) {
+        report.message(MessageId.RSC_029, location());
+        return;
+      }
       if (context.isRemote(url))
       {
         report.info(path, FeatureEnum.REFERENCE, href);

src/test/resources/epub3/03-resources/files/data-url-in-package-link-error.opf

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<package xmlns="http://www.idpf.org/2007/opf" version="3.0" xml:lang="en" unique-identifier="q">
+  <metadata xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <dc:title id="title">Minimal EPUB 3.0</dc:title>
+    <dc:language>en</dc:language>
+    <dc:identifier id="q">NOID</dc:identifier>
+    <meta property="dcterms:modified">2017-06-14T00:00:01Z</meta>
+    <link rel="alternate" href="data:application/xhtml+xml,%3Ch1%3EHello%3C%2Fh1%3E" media-type="application/xhtml+xml"/>
+  </metadata>
+  <manifest>
+    <item id="nav" href="nav.xhtml" media-type="application/xhtml+xml" properties="nav"/>
+    <item id="content_001" href="content_001.xhtml" media-type="application/xhtml+xml"/>
+  </manifest>
+  <spine>
+    <itemref idref="content_001"/>
+  </spine>
+</package>

src/test/resources/epub3/03-resources/resources.feature

@@ -493,16 +493,23 @@
   ## 3.7 Data URLs
 
   @spec @xref:sec-data-urls
-  Scenario: Allow a data URL in a manifest item not in the spine
-    When checking file 'data-url-in-manifest-item-valid.opf'
-    Then no errors or warnings are reported
+  Scenario: Report a data URL in a manifest item href (not in the spine)
+    When checking file 'data-url-in-manifest-item-error.opf'
+    Then error RSC-029 is reported
+    And no other errors or warnings are reported
 
   @spec @xref:sec-data-urls
-  Scenario: Report a data URL in a manifest item referenced in the spine
+  Scenario: Report a data URL in a manifest item href (referenced in the spine)
     When checking file 'data-url-in-manifest-item-in-spine-error.opf'
     Then error RSC-029 is reported
     And no other errors or warnings are reported
 
+  @spec @xref:sec-data-urls
+  Scenario: Report a data URL in a package link href
+    When checking file 'data-url-in-package-link-error.opf'
+    Then error RSC-029 is reported
+    And no other errors or warnings are reported
+
   @spec @xref:sec-data-urls
   Scenario: Report a data URL in the `href` attribute of an HTML `a` element
     When checking file 'data-url-in-html-a-href-error.xhtml'
@@ -536,11 +543,6 @@
     When checking EPUB 'data-url-in-html-img-foreign-intrinsic-fallback-valid'
     And no errors or warnings are reported
 
-  @spec @xref:sec-data-urls
-  Scenario: Allow a data URL defining a foreign resource with a manifest fallback (in an HTML `img` element)
-    When checking EPUB 'data-url-in-html-img-foreign-manifest-fallback-valid'
-    And no errors or warnings are reported
-
   @spec @xref:sec-data-urls
   Scenario: Report a data URL defining a foreign resource with no fallback (in an HTML `img` element)
     When checking EPUB 'data-url-in-html-img-foreign-no-fallback-error'