1

I've been running some experiments and it's clear to me that an SVG Data URL like this:

data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 36 36'%3E%3Cpath fill='%23A0041E' d='M1 17l8-7 16 1 1 16-7 8s.001-5.999-6-12-12-6-12-6z'/%3E%3Cpath fill='%23FFAC33' d='M.973 35s-.036-7.979 2.985-11S15 21.187 15 21.187 14.999 29 11.999 32c-3 3-11.026 3-11.026 3z'/%3E%3Ccircle fill='%23FFCC4D' cx='8.999' cy='27' r='4'/%3E%3Cpath fill='%2355ACEE' d='M35.999 0s-10 0-22 10c-6 5-6 14-4 16s11 2 16-4c10-12 10-22 10-22z'/%3E%3Cpath d='M26.999 5c-1.623 0-3.013.971-3.641 2.36.502-.227 1.055-.36 1.641-.36 2.209 0 4 1.791 4 4 0 .586-.133 1.139-.359 1.64 1.389-.627 2.359-2.017 2.359-3.64 0-2.209-1.791-4-4-4z'/%3E%3Cpath fill='%23A0041E' d='M8 28s0-4 1-5 13.001-10.999 14-10-9.001 13-10.001 14S8 28 8 28z'/%3E%3C/svg%3E

will work in Firefox 83 (for desktop) but doesn't appear to be working in Firefox Mobile 83.1.0 (on Android).

Is there any way around this, or is this a security feature exclusively for mobile browsers for which there is no way around?


Added: For clarity, yes, this issue also appears to affect Chrome Mobile 86.

4
  • 1
    It looks like you URL encoded some things in the URL, but not the spaces or the single quotes. Neither of those characters are safe for URLs and should always be encoded. Have you tried a fully encoded URL? – Stephen Ostermiller Dec 3 '20 at 10:18
  • Good suggestion, @StephenOstermiller. I've now tried a version of the Data URL with everything percent-encoded apart from [A-Za-z0-9-\.] but it gives the same result. – Rounin Dec 3 '20 at 11:01
  • Now that I've answered your other question about characters allowed in data URIs, I was wrong about single quotes, they are allowed. But not the spaces. Good to know that wasn't the issue anyway. – Stephen Ostermiller Dec 3 '20 at 11:10
  • 1
    When researching to answer that question I ran across developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/… which says that due to security problems with data URIs, browsers now block clicks that would show data URI in the top level browser URL bar. I'm not sure if that blocking is causing the problems you report here, but it seems plausible. – Stephen Ostermiller Dec 3 '20 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.