Data URIs

[lovasoa]

Hello !

I am the maintainer of SQLPage, which embeds markdown-rs.
Recently, an user reported that image data-URIs do not work in markdown: sqlpage/SQLPage#803 (reply in thread)

Is this on purpose ? Could image data-URI support be added ?

[lovasoa]

The following markdown:

![a red dot](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==)

is rendered as

<img src="" alt="a red dot" />

[wooorm]

hi! yes, they are unsafe. see https://github.com/wooorm/markdown-rs#security!

[lovasoa]

Oh, sorry for opening the issue without checking that first.

Any reason why you consider data URLs unsafe ?

[lovasoa]

I understand why they could be considered unsafe in the context of a link, but what about images ?

[wooorm]

Images don’t need interaction, those srcs run. A quick duckduckgo gives me stuff like https://wiki.zacheller.dev/web-app-pentest/xss/data-urls

[lovasoa]

So, if we want to run JS we can actually inject either of these into a URL:

data:text/html,<script>alert('hi');</script>
data:text/javascript,alert(1)  

• https://wiki.zacheller.dev/web-app-pentest/xss/data-urls

This is wrong and easily debunked. Just paste the following to an html file and open it :

<img src="data:text/javascript,alert(1)" />

The javascript is not executed.

If we allow http URLs pointing to any domain, then allowing data URIs does not increase the attack surface in any way.
Anything included in a data URI could just as well be returned by a remote attacker-controlled server in a normal HTTP URL.

[wooorm]

this may have changed / may be different per browser or based on file:/localhost

the difference is the cross-origin thing, where something on a remote url executes on that remote url, whereas something in a data url executes from the same url

[wooorm]

It’s also something that GH + the sanitizers I know do, so I’m doubtful that it suddenly is completely safe

[lovasoa]

The reason github does it is probably related to caching.

On github, the following markdown:

![](http://example.com)

is rendered as

<img src="https://camo.githubusercontent.com/7f71acf223968ffae7687e6452f172b5744538e32b3752ca11744db019aa1c16/687474703a2f2f6578616d706c652e636f6d" alt="" data-canonical-src="http://example.com" style="max-width: 100%;">

Github caches images on their own servers, and do not want to overload pages with large data URIs.

But in a standalone markdown rendering library, there is no reason to consider image data URIs as dangerous.

[wooorm]

That GH behavior has more to do with fixing https headers and warnings: https://github.com/rehypejs/camomile#when-should-i-use-this (see also https://github.com/github/html-pipeline/blob/master/lib/html/pipeline/camo_filter.rb).
The allow-list of protocols comes originally from https://github.com/github/html-pipeline/blob/97e5e97d85e1158ab4c0db2a0b9cbff6486ae8a1/lib/html/pipeline/sanitization_filter.rb#L77-L87

[lovasoa]

I opened a pull request to enable data URLs in images : #164

Do not hesitate to ask if you have any question.