Resolve #3413396 "Xss fiter data uri support for images"

Closes #3413396

added 1 commit

• b4a81127 - Add support for inline images with data uri scheme

Compare with previous version

Feels like this should be added as an extra possible condition in case 0 where we set $skip_protocol_filtering to TRUE?

Oh, we need the attribute value so we can't. But should we break out the ternary below into if..elseif..else, and add some comments here as to why we are doing this? Comments in this method are extremely important.

Do we care about any tags other than img? Should we check the attribute name is src?

Also this regex only cares about " as the string delimiter, what about the later cases if someone uses<img src='data:image...'>? Is it allowed to have whitespace between the quote and data:, or between data: and image, or before the closing quote?

Is that the only way svg+xml can be represented or could there be capitalisation or escaping that could bypass this check but still embed SVG?

changed this line in version 3 of the diff

Is that the only way svg+xml can be represented or could there be capitalisation

Good catch. !6080 (411e1ea9)

Both top-level type and subtype names are case-insensitive.

https://datatracker.ietf.org/doc/html/rfc6838#section-4.2

or escaping that could bypass this check but still embed SVG?

Since the current regex-based approach is simple, I do not see how that would be possible.

added 3 commits

• cb36534c - Removed unnecessary deprecation warning
• 411e1ea9 - Handle potential uppercase characters in image media type part
• 908d4fc2 - Added RFC references

Compare with previous version

As @longwave and @chx highlighted on Drupal Slack, a deprecation warning is not required, which also means that a change record is not required either.

Protected methods of a class should be assumed @internal and subject to change unless either the class or method itself are marked with @api.

This is admittedly a KISS approach.

believe this should be string|null

And comment should note it could be null?