wikimedia / mediawiki

				&& strpos( $value, 'data:' ) !== 0

				&& strpos( $value, '#' ) !== 0

			) {

				if ( !( $strippedElement === 'a'

					&& preg_match( '!^https?://!im', $value ) )

				) {

					wfDebug( __METHOD__ . ": Found href attribute <$strippedElement "

						. "'$attrib'='$value' in uploaded file.\n" );

					return [ 'uploaded-href-attribute-svg', $strippedElement, $attrib, $value ];

				}

			}

			# only allow data: targets that should be safe. This prevents vectors like,

				$parameters = '(?>;[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+=(?>[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+|"(?>[\0-\x0c\x0e-\x21\x23-\x5b\x5d-\x7f]+|\\\\[\0-\x7f])*"))*(?:;base64)?';

				// @codingStandardsIgnoreEnd

				if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i", $value ) ) {

					wfDebug( __METHOD__ . ": Found href to unwhitelisted data: uri "

						. "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );

					return [ 'uploaded-href-unsafe-target-svg', $strippedElement, $attrib, $value ];

				}

			}

			# Change href with animate from (http://html5sec.org/#137).