Image sources allow everything safeHref does, plus the two schemes
that only ever yield inert bytes: data:image/* and blob:. Both are
produced by the bundled storage adapters, and neither can execute, unlike
a data:text/html href, which is why links keep the stricter rule.
Image sources allow everything safeHref does, plus the two schemes that only ever yield inert bytes:
data:image/*andblob:. Both are produced by the bundled storage adapters, and neither can execute, unlike adata:text/htmlhref, which is why links keep the stricter rule.