do not reject data: protocol

[kapouer]

Though i don't have a clear idea if data: protocol can be a xss attack vector.
Maybe at least uri starting with data:image/ should be allowed - they should be pretty harmless.

[straker]

The data protocol can allow attack vectors through data:text/html, so we shouldn't allow that. It's also possible in Firefox (even current) to use the embed element and data:image/svg+xml as an attack vector.

These are the only examples I could find, but I'm not a security expert. From what I've read, to guarantee XSS prevention you should only accept http and https.

[kapouer]

It feels odd, though, to discard mecanisms upstream. User of template strings should not merge unsafe data in the first place...