[issue2551099] Handle data: schema like javascript: schema in markdown

New submission from John Rouillard:

Data url's can be abused similar to javascript url's.

Disable them, display straight text when entered using markdown.

User should be able to re-enable on a tracker by modifying
_disable_url_schemes in templating.py from interfaces.py.

Ref:
https://resources.infosecinstitute.com/topic/phishing-with-data-uri/

https://blog.mozilla.org/security/2017/11/27/blocking-top-level-
navigations-data-urls-firefox-59/

https://en.wikipedia.org/wiki/Data_URI_scheme#Malware_and_phishing

----------
assignee: rouilj
keywords: Effort-Low
messages: 7019
nosy: rouilj
priority: normal
severity: normal
status: new
title: Handle data: schema like javascript: schema in markdown
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551099>
_________________________________________________