Ambiguities in the data URL scheme

Last updated on 11 November 2014.

Feedback:

File an issue

IRC: #whatwg on Freenode

The data URL scheme is defined by RFC 2397, which unfortunately is vague regarding many details of the syntax. This document lists some of the details that should be specified in a future, more precise specification.

See also Bug 19494 on the W3C Bugzilla and other stuff linked from there.

• If the URL has a query, the ? separator and the query string should be part of the input to the data URL parsing algorithm.
• However if the URL has a fragment, the # separator and the fragment identifier string should not be part of the input. Instead, the fragment identifier has the meaning and behavior as it would e.g. with an http URL.
• Although it is often not necessary, percent-encoding still applies to base64-encoded data URLs.
• The first U+002C comma of the input separates the MIME type from the data. Does this still apply in that comma is inside a MIME quoted string for a parameter value? Example: data:text/plain;foo="bar,baz";charset=utf8,body
• What about a percent-encoded comma? Example: data:text/plain;foo=bar%2Cbaz;charset=utf8,body

• How strictly should the parser look for ;base64? Examples:

  data:text/plain;base64,Rm9vCg==
  data:text/plain; base64,Rm9vCg==
  data:text/plain;base64 ,Rm9vCg==
  data:text/plain;base 64,Rm9vCg==
  data:text/plain;Base64,Rm9vCg==
  data:text/plain;%62ase64,Rm9vCg==
  data:text/plain%3Bbase64,Rm9vCg==
  

  When RFC 2397 says:

  The ";base64" extension is distinguishable from a content-type parameter by the fact that it doesn't have a following "=" sign.

  Does this mean that other MIME parsing rules apply?

• How should percent-encoding interact with MIME type parsing? Examples:

  data:text/plain;charset=utf8,%F0%9F%92%A9
  data:text/plain%3Bcharset=utf8,%F0%9F%92%A9
  data:text/plain;charset%3Dutf8,%F0%9F%92%A9
  data:text/plain;charset="utf8%22,%F0%9F%92%A9
  data:text/plain;charset=utf8,%F0%9F%92%A9
  

• Although RFC 2397 doesn’t bother with a normative reference, base64 in IETF-land is defined by RFC 4648, which defines both The Base 64 Alphabet and The "URL and Filename safe" Base 64 Alphabet. Which of them should be used? The former looks like the one to be used by default, but the latter sounds kinda relevant. Or should both of them be accepted?
• What should happen to non-alphabet characters in base64 data? Options include ignoring them, or making parsing fail (return the equivalent of a network error.) Should this differ for whitespace and other non-alphabet characters?
• What should happen if base64 data has too little padding (including none) or too much?