Is it expected that base64 images are stripped?

[uncleramsay]

Hi, I'm using rehype-sanitize with react-markdown and I notice that my base64 images no longer work:

<img src=\"data:image/png;base64,iVBORw0KGgoA...." />

is being rendered as

<img />

Removing the sanitize plugin restores the image. Are base64 strings dangerous in some way?

[wooorm]

Yes, they are. I pasted the image below and GH strips them.

[uncleramsay]

Interesting, do you have any idea why? I can't seem to find any articles that explain what the danger is - only that they are inefficient.

[wooorm]

The terms "data uri security" give me many results. In short, they can contain anything, such as scripts, but images themselves also have security issues associated with them