relnote(122): SVG use elements cannot use data URIs

[bsmth]

For security reasons, the following is no longer allowed:

<svg>
  <use href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0i...#x" />
</svg>

The same is true for setAttribute:

<use>
  <set attributeName="href" to="data:image/svg+xml;base64,PHN2ZyB4bWxuc..."/>
</use>

and in JS:

use.setAttribute("href", "data:image/svg+xml;base64,PHN2ZyB4...

Bugzilla:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1806964

Related issues and pull requests:

• Parent issue [SVG] Restrict SVG <use> to prevent usage of data: URLs #31111

Additional resources:

• WPT: https://wpt.fyi/results/svg/struct/reftests?q=use-data-url&run_id=5068628946321408&run_id=5145593350979584&run_id=5073275899609088&run_id=5116444011921408

[github-actions]

Preview URLs

• /en-US/docs/Mozilla/Firefox/Releases/122

External URLs (1)

URL: /en-US/docs/Mozilla/Firefox/Releases/122
Title: Firefox 122 for developers

• https://bugzil.la/1806964 (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2024-01-09 11:31:53)

[pepelsbey]

There’s also a href attribute for the <image> element in SVG. I wonder if it’s also affected by this limitation, not just <use>.

[bsmth]

There’s also a href attribute for the <image> element in SVG. I wonder if it’s also affected by this limitation, not just <use>.

This is only in <use> as there's special handling going on when you call it (cloning elements and modifying the DOM).

[pepelsbey]

LGTM! Thanks :)

[bsmth]

Thank you!