Skip to content

Conversation

blag
Copy link

@blag blag commented Apr 28, 2014

From https://en.wikipedia.org/wiki/Data_URI_scheme#Format, allow the psuedo-protocol 'data'. This allows base64-encoded image data to be embedded with, eg: tags.

@hoppipolla-critic-bot
Copy link

Critic review: https://critic.hoppipolla.co.uk/r/1404

This is an external review system which you may optionally use for the code review of your pull request.

In order to help critic track your changes, please do not make in-place history rewrites (e.g. via git rebase -i or git commit --amend) when updating this pull request.

@gsnedders
Copy link
Member

Allowing data URIs in general is unsafe. Consider, e.g., <iframe src="data:text/html,<script>alert(parent.cookies)%3B<%2Fscript>">. As such, this cannot be merged as is; data URIs would need to be handled separately with a whitelist of MIME types that do not allow scripting.

@gsnedders
Copy link
Member

Closing for now; probably best to create an entirely new PR for anything that provides a data URI sanitization scheme, as that's probably a fair bit of work on its own.

@gsnedders gsnedders closed this Apr 28, 2014
@gsnedders
Copy link
Member

Oh, wait, iframes are blocked anyway. Duh. I think you can still do this with <img> and SVG, though?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants