Intent to unship: data URL support in SVG use elements

[Tom Schuster]

As of Firefox 122 I intend to remove support for data: URLs in the href attribute of SVG <use> elements. It was never supported in Safari and Chrome is planning to remove support in Chrome 120. data URLs can be used for XSS attacks, by embedding another SVG that executes scripts.

Bug to remove: https://bugzilla.mozilla.org/show_bug.cgi?id=1806964
Standards position: https://github.com/mozilla/standards-positions/issues/718
Preference: svg.use-element.data-url-href.allowed

Chrome's intent to deprecate: https://groups.google.com/a/chromium.org/g/blink-dev/c/Q9dLyBhtZTw/m/ceirsUk7AgAJ