Re: [svgwg] Remove support for data: URL in SVGUseElement (#901)

> I think we should essentially require a same origin URL here (and also enforce that for redirects, which would be easy if this was defined in terms of fetch...).
> 
> And no longer have "user agents may" or "a future version of". Let's actually settle this.

Thanks! Since https://github.com/w3c/svgwg/issues/707 got closed, I've removed the `a future version of` bit.
However, I think `User agents may restrict external resource documents for security reasons` bit is still necessary. For example, Blink enforced restrictions on external resource documents such as:

1. `<foreignObject>` is not supported.
2. Event handlers doesn't fire.

@caribouW3, I've got a [positive signal from Mozilla](https://github.com/mozilla/standards-positions/issues/718#issuecomment-1347915887) and [Webkit is likely supportive](https://github.com/WebKit/standards-positions/issues/108#issuecomment-1354354703) (pending formal decision until January 6th).
Is there anything else I need consensus on to land this change?


-- 
GitHub Notification of comment by shhnjk
Please view or discuss this issue at https://github.com/w3c/svgwg/pull/901#issuecomment-1358195469 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 19 December 2022 19:55:33 UTC