From 1552632b9f756783bf5d95f6f69ccce1aef1272f Mon Sep 17 00:00:00 2001 From: Brian Thomas Smith Date: Mon, 18 Dec 2023 17:28:41 +0100 Subject: [PATCH 1/2] relnote(122): SVG use elements cannot use data URIs --- files/en-us/mozilla/firefox/releases/122/index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/files/en-us/mozilla/firefox/releases/122/index.md b/files/en-us/mozilla/firefox/releases/122/index.md index e1ef34c0668169c..aed08c3a5b67ab4 100644 --- a/files/en-us/mozilla/firefox/releases/122/index.md +++ b/files/en-us/mozilla/firefox/releases/122/index.md @@ -28,6 +28,9 @@ This article provides information about the changes in Firefox 122 that affect d #### Removals +- Removed support for `data:` URLs in SVG `` elements and via the [`SVGUseElement`](/en-US/docs/Web/API/SVGUseElement) interface to prevent [XSS](/en-US/docs/Glossary/Cross-site_scripting) attacks. + This functionality is behind the preference `svg.use-element.data-url-href.allowed` which can be set to `true` to enable the legacy behavior ([Firefox bug 1806964](https://bugzil.la/1806964)). + ### HTTP #### Removals From a83d149f3165165403e55f825ac1acb56b4f9a9a Mon Sep 17 00:00:00 2001 From: Brian Thomas Smith Date: Mon, 8 Jan 2024 14:37:24 +0100 Subject: [PATCH 2/2] Update files/en-us/mozilla/firefox/releases/122/index.md Co-authored-by: Vadim Makeev --- files/en-us/mozilla/firefox/releases/122/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/en-us/mozilla/firefox/releases/122/index.md b/files/en-us/mozilla/firefox/releases/122/index.md index aed08c3a5b67ab4..47f25ca8df94764 100644 --- a/files/en-us/mozilla/firefox/releases/122/index.md +++ b/files/en-us/mozilla/firefox/releases/122/index.md @@ -29,7 +29,7 @@ This article provides information about the changes in Firefox 122 that affect d #### Removals - Removed support for `data:` URLs in SVG `` elements and via the [`SVGUseElement`](/en-US/docs/Web/API/SVGUseElement) interface to prevent [XSS](/en-US/docs/Glossary/Cross-site_scripting) attacks. - This functionality is behind the preference `svg.use-element.data-url-href.allowed` which can be set to `true` to enable the legacy behavior ([Firefox bug 1806964](https://bugzil.la/1806964)). + The legacy functionality may be re-enabled by setting the `svg.use-element.data-url-href.allowed` preference to `true`, although this is not recommended for security reasons ([Firefox bug 1806964](https://bugzil.la/1806964)). ### HTTP