1.0.15

Security

Base64-encoded data: URLs slipped past the href / xlink:href checks (ref GHSA-wcj2-r6vg-rm97, reported by @0xMoError-22).

The old check rejected javascript: by scheme but judged data: URLs by a payload-content heuristic — the literal substring onload. Because data: payloads are routinely Base64-encoded, the dangerous content (<script>, event handlers) never existed as a literal substring, so data:text/html;base64,… carrying a complete embedded document survived sanitization in both HTML and SVG modes.

data: URLs are now judged by scheme policy, mirroring the javascript: rejection: any data: URL in href / xlink:href is removed unless it declares an inert image MIME type (image/png, image/jpeg, image/gif, image/webp, image/bmp, image/x-icon). Script-capable types — text/html, image/svg+xml, application/xhtml+xml — are rejected regardless of encoding. Legitimate inline image hrefs (base64 PNG icons and the like) keep working, and the post-serialization regex pass gained the same policy as a second net.

On severity: Medium. Current Chrome, Firefox and Safari block top-level navigation to data:text/html URLs, so this was a defense-in-depth gap at the sanitizer's filtering boundary rather than directly executable XSS. Suite is green at 98 tests / 196 assertions.

Anyone embedding untrusted SVG or HTML should update. Grav users should take the next Grav release, which bundles this version.