The "data" URL scheme
Extracted elements (12)
The data URL scheme has no relative URL forms. This is an explicit design decision noted without elaboration, likely because inline data is self-contained and has no meaningful base URI context.
The quoted-printable encoding was eliminated as an option because it would not easily yield valid URLs without additional %xx encoding, which is itself sufficient. This simplifies the encoding model to just raw percent-encoding or base64.
The scheme is intended only for small data items. For anything larger than a small inline image, data URLs are likely inappropriate due to application-imposed length limits and unknown behavior with large values.
HTML imposes length limits on attribute values that constrain data URL usability: LITLEN (1024) limits a single attribute value literal, ATTSPLEN (2100) limits the sum of all attribute value lengths in a tag, and TAGLEN (2100) limits overall tag length (per RFC 1866).
If the mediatype is omitted, it defaults to `text/plain;charset=US-ASCII`. As a shorthand, `text/plain` may be omitted while still supplying the charset parameter.
Parameter values that contain any `tspecial` characters should use URL Escaped encoding instead of the quoted-string representation, because the quote mark is not a valid urlchar within a data URL.
The `;base64` extension is distinguishable from a content-type parameter by the absence of a following `=` sign, allowing unambiguous parsing of the URL structure.
The formal syntax is: `dataurl := "data:" [ mediatype ] [ ";base64" ] "," data`, where `mediatype := [ type "/" subtype ] *( ";" parameter )` and `data := *urlchar` imported from RFC 2396.
Firewall proxies that filter retrieval of certain media types (e.g., application script languages) will find it difficult to screen against those types when embedded via the data URL scheme, as the data is inline rather than fetched from a remote server.
Interpreting data within a data URL carries the same security considerations as any implementation of the given media type. An application should not interpret data URLs marked with a media type that has been disallowed by the application's configuration.
The effect of long data URLs in applications is unknown; some software may exhibit unreasonable behavior (e.g., buffer overflows) when data exceeds an allocated buffer size. Implementors should apply appropriate size limits.
The data URL has the form: `data:[<mediatype>][;base64],<data>`. The mediatype is an Internet media type with optional parameters; `;base64` signals base64 encoding; otherwise data is percent-encoded per RFC 2396.