1 files changed, 11 insertions, 0 deletions
diff --git a/dom/svg/SVGUseElement.cpp b/dom/svg/SVGUseElement.cpp
index acd8941b4e..8da90634ad 100644
--- a/dom/svg/SVGUseElement.cpp
+++ b/dom/svg/SVGUseElement.cpp
@@ -426,6 +426,17 @@ SVGUseElement::LookupHref()
   nsCOMPtr<nsIURI> targetURI;
   nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(targetURI), href,
                                             GetComposedDoc(), baseURI);
+  
+  // Do not allow 'data:' schemes in <use> elements.
+  // See spec update: https://github.com/w3c/svgwg/pull/901
+  if (targetURI) {
+    bool isData;
+    mozilla::Unused << targetURI->SchemeIs("data", &isData);
+    if (isData) {
+      return;
+    }
+  }
+  
   mSource.Reset(this, targetURI);
 }