# QA-15, MIM-15: data: URLs -- img[src] only, image/png|jpeg|gif|webp only, <= 2 MiB.
# Type confusion, parameters, padding and case tricks. The 2 MiB boundary and the
# 2 MiB + 1 image are generated in test_payload_corpus.py (too big for a text file).

== data-png-kept
expect: has-data keeps-text=SAFE
--
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==">SAFE

== data-jpeg-gif-webp-kept
expect: has-data keeps-text=SAFE
--
<img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQ=="><img src="data:image/gif;base64,R0lGODlhAQABAAAAACw="><img src="data:image/webp;base64,UklGRhoAAABXRUJQVlA4">SAFE

== data-svg
source: SVG is a script container
expect: no-data keeps-text=SAFE
--
<img src="data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+PC9zdmc+">SAFE

== data-svg-uppercase
expect: no-data keeps-text=SAFE
--
<img src="DATA:IMAGE/SVG+XML,&lt;svg onload=alert(1)&gt;">SAFE

== data-svg-utf8
expect: no-data keeps-text=SAFE
--
<img src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'/>">SAFE

== data-svg-param-says-png
source: a parameter that names an allowed type does not make the type allowed
expect: no-data keeps-text=SAFE
--
<img src="data:image/svg+xml;type=image/png;base64,PHN2Zz4=">SAFE

== data-png-then-svg-type
source: only the first type counts; anything after ';' is a parameter
expect: keeps-text=SAFE
--
<img src="data:image/png;image/svg+xml;base64,PHN2Zz4=">SAFE

== data-text-html
expect: no-data keeps-text=SAFE
--
<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">SAFE

== data-xhtml
expect: no-data keeps-text=SAFE
--
<img src="data:application/xhtml+xml,<html xmlns='http://www.w3.org/1999/xhtml'><script>alert(1)</script></html>">SAFE

== data-no-type
source: a missing type defaults to text/plain
expect: no-data keeps-text=SAFE
--
<img src="data:;base64,iVBORw0KGgo="><img src="data:,iVBORw0KGgo=">SAFE

== data-no-comma
expect: no-data keeps-text=SAFE
--
<img src="data:image/png;base64">SAFE

== data-jpg-alias
source: image/jpg is not a registered type and not on the list
expect: no-data keeps-text=SAFE
--
<img src="data:image/jpg;base64,/9j/4AAQ">SAFE

== data-type-with-spaces
expect: keeps-text=SAFE
--
<img src="data: image/svg+xml ;base64,PHN2Zz4="><img src="data:image/svg+xml ;base64,PHN2Zz4=">SAFE

== data-type-entity-obfuscated
expect: no-data keeps-text=SAFE
--
<img src="&#100;ata:image/svg+xml;base64,PHN2Zz4="><img src="da&#x09;ta:text/html,x"><img src=" data:image/svg+xml;base64,PHN2Zz4=">SAFE

== data-type-percent-encoded
expect: keeps-text=SAFE
--
<img src="data:image%2Fsvg%2Bxml;base64,PHN2Zz4=">SAFE

== data-png-markup-body
source: a png that is really markup: the type is what the renderer obeys
expect: keeps-text=SAFE
--
<img src="data:image/png,<svg/onload=alert(1)>">SAFE

== data-base64-padding-tricks
expect: keeps-text=SAFE
--
<img src="data:image/png;base64,===="><img src="data:image/png;base64,iVBO%3D%3D"><img src="data:image/png;base64,iV BO RwoK"><img src="data:image/png;base64,i=V=B=O"><img src="data:image/png;base64,iVBORw0KGgo=====">SAFE

== data-in-href
expect: no-scheme=data keeps-text=SAFE
--
<a href="data:image/png;base64,iVBORw0KGgo=">SAFE</a>

== data-in-background
expect: no-scheme=data keeps-text=SAFE
--
<table background="data:image/png;base64,iVBORw0KGgo="><tr><td>SAFE</td></tr></table>

== data-in-css
expect: no-css-value=url( keeps-text=SAFE
--
<div style="background:url(data:image/png;base64,iVBORw0KGgo=)">SAFE</div><div style="background:url(data:image/svg+xml;base64,PHN2Zz4=)">x</div>

== data-in-cite
expect: no-scheme=data keeps-text=SAFE
--
<blockquote cite="data:text/html,x">SAFE</blockquote>
