Src of <img> whose value is base64 encoded, is removed about dompurify

[cure53]

That's a problem indeed. With data URIs, an attacker can do bad. Not in all contexts. But some. For example, data URIs are bad for <a> but not for <img>. Then they are fine for SVG's <image> but not for for mask or even <object> - unless the type indicates it's an image. We can have XSS with data URIs in Firefox - but only script execution in Chrome (on about:blank) and so on and so on.

This lead to the decision that data URIs are bad and cannot be trusted. I want to avoid having a maintenance-heavy if-else-tree deciding when data URI s re good and when they are bad. So I consider them all to be bad. Same with srcdoc for example.

[hyderali]

This is an important requirement, without this all the images appears just blank.

[cure53]

I believe this should work now. I enabled data URIs for <img> and <img> only as in most other context we can do bad. Meets the requirements?

Side-note: Data URIs in CSS should be enabled by default.

[hyderali]

Thank you.
@cure53 You rock 👍