From 6491886ec9b64a44099983cdc646e22215ef8ffa Mon Sep 17 00:00:00 2001 From: Brian Thomas Smith Date: Fri, 12 Jan 2024 17:35:21 +0100 Subject: [PATCH 1/3] feat(svg): Add usage note on deprecation of data URIs in use href attr --- files/en-us/web/svg/element/use/index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/files/en-us/web/svg/element/use/index.md b/files/en-us/web/svg/element/use/index.md index cd6ce905ccb4767..16b4ac4cd7be98b 100644 --- a/files/en-us/web/svg/element/use/index.md +++ b/files/en-us/web/svg/element/use/index.md @@ -78,9 +78,13 @@ Since the cloned nodes are not exposed, care must be taken when using [CSS](/en- For security reasons, browsers may apply the [same-origin policy](/en-US/docs/Web/Security/Same-origin_policy) on `use` elements and may refuse to load a cross-origin URL in the {{SVGAttr("href")}} attribute. There is currently no defined way to set a cross-origin policy for `use` elements. +> **Warning:** Loading resources with data URIs in the `href` attribute is deprecated for security reasons. +> This applies to ` Date: Wed, 17 Jan 2024 17:37:09 +0100 Subject: [PATCH 2/3] relnote(122): Improve language based on reviewer feedback, link to usage notes --- files/en-us/web/svg/element/use/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/files/en-us/web/svg/element/use/index.md b/files/en-us/web/svg/element/use/index.md index 16b4ac4cd7be98b..8a8a48cf49018a5 100644 --- a/files/en-us/web/svg/element/use/index.md +++ b/files/en-us/web/svg/element/use/index.md @@ -36,7 +36,7 @@ svg { ## Attributes - {{SVGAttr("href")}} - - : The URL to an element/fragment that needs to be duplicated.
_Value type_: [**``**](/en-US/docs/Web/SVG/Content_type#url) ; _Default value_: none; _Animatable_: **yes** + - : The URL to an element/fragment that needs to be duplicated. See [Usage notes](#usage_notes) for details on common pitfalls.
_Value type_: [**``**](/en-US/docs/Web/SVG/Content_type#url) ; _Default value_: none; _Animatable_: **yes** - {{SVGAttr("xlink:href")}} {{Deprecated_Inline}} - : An [``](/en-US/docs/Web/SVG/Content_type#iri) reference to an element/fragment that needs to be duplicated. If both {{SVGAttr("href")}} and {{SVGAttr("xlink:href")}} are present, the value given by {{SVGAttr("href")}} is used.
_Value type_: [**``**](/en-US/docs/Web/SVG/Content_type#iri) ; _Default value_: none; _Animatable_: **yes** - {{SVGAttr("x")}} @@ -79,8 +79,8 @@ Since the cloned nodes are not exposed, care must be taken when using [CSS](/en- For security reasons, browsers may apply the [same-origin policy](/en-US/docs/Web/Security/Same-origin_policy) on `use` elements and may refuse to load a cross-origin URL in the {{SVGAttr("href")}} attribute. There is currently no defined way to set a cross-origin policy for `use` elements. > **Warning:** Loading resources with data URIs in the `href` attribute is deprecated for security reasons. -> This applies to ``](/en-US/docs/Web/SVG/Element/set) or [`setAttribute`](/en-US/docs/Web/API/Element/setAttribute) method. +> See "Load from data: URI" in the [Browser compatibility](#browser_compatibility) table to check support in different browser versions. > **Warning:** Since SVG 2, the {{SVGAttr("xlink:href")}} attribute is deprecated in favor of {{SVGAttr("href")}}. See {{SVGAttr("xlink:href")}} page for more information. From 3cbae1fa238ed24cafb0024611930edbfb11971b Mon Sep 17 00:00:00 2001 From: Brian Thomas Smith Date: Wed, 17 Jan 2024 19:14:03 +0100 Subject: [PATCH 3/3] Update files/en-us/web/svg/element/use/index.md Co-authored-by: Dipika Bhattacharya --- files/en-us/web/svg/element/use/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/en-us/web/svg/element/use/index.md b/files/en-us/web/svg/element/use/index.md index 8a8a48cf49018a5..855e008bf886abf 100644 --- a/files/en-us/web/svg/element/use/index.md +++ b/files/en-us/web/svg/element/use/index.md @@ -79,7 +79,7 @@ Since the cloned nodes are not exposed, care must be taken when using [CSS](/en- For security reasons, browsers may apply the [same-origin policy](/en-US/docs/Web/Security/Same-origin_policy) on `use` elements and may refuse to load a cross-origin URL in the {{SVGAttr("href")}} attribute. There is currently no defined way to set a cross-origin policy for `use` elements. > **Warning:** Loading resources with data URIs in the `href` attribute is deprecated for security reasons. -> This applies to ` See "Load from data: URI" in the [Browser compatibility](#browser_compatibility) table to check support in different browser versions. > **Warning:** Since SVG 2, the {{SVGAttr("xlink:href")}} attribute is deprecated in favor of {{SVGAttr("href")}}. See {{SVGAttr("xlink:href")}} page for more information.