relnote(122): SVG use elements cannot use data URIs (#31124)

* relnote(122): SVG use elements cannot use data URIs * Update files/en-us/mozilla/firefox/releases/122/index.md Co-authored-by: Vadim Makeev <[email protected]> --------- Co-authored-by: Vadim Makeev <[email protected]>
mdn · Jan 12, 2024 · d8f4d73 · d8f4d73
1 parent f1177f3
commit d8f4d73
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/files/en-us/mozilla/firefox/releases/122/index.md b/files/en-us/mozilla/firefox/releases/122/index.md
@@ -38,6 +38,9 @@ This article provides information about the changes in Firefox 122 that affect d
 
 #### Removals
 
+- Removed support for `data:` URLs in SVG `<use>` elements and via the [`SVGUseElement`](/en-US/docs/Web/API/SVGUseElement) interface to prevent [XSS](/en-US/docs/Glossary/Cross-site_scripting) attacks.
+  The legacy functionality may be re-enabled by setting the `svg.use-element.data-url-href.allowed` preference to `true`, although this is not recommended for security reasons ([Firefox bug 1806964](https://bugzil.la/1806964)).
+
 ### HTTP
 
 #### Removals