data: protocol in img tag src attribute not allowed for basicWithImages by default

[RaphiD]

Hi, why is the data protocol not allowed by default if I use the basicWithImages safe list to clean HTML content?

Javadoc:
This safelist allows the same text tags as {@link #basic}, and also allows img tags, with appropriate attributes, with src pointing to http or https.

[ecki]

Specifically, we wonder if there is an additional risk involved (like the can contain js and is miss-interpreted by (older) browsers or src=data: might be somehow re-used for <script>. Asuming JSoup gets that right, is it safe to allow it - or would you conider adding it to basic protocols? (I mean data: sounds less dangerous as any untrusted remote url, right?)

[MasterChiefNemo]

Would I be correct in saying the safelist is used to sanitize data being parsed by JSoup?

[ecki]

What do you mean? The safelist which allows image tags does not allow them if they are inline. The question is why