Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction

Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - : SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside , so the check never matched on the HTML5 path. ...