Follow-up: allow safe data:image/* schemes via url_filter in SVG sanitizer #5851

Follow-up to #5514.

The SVG sanitizer added in that fix currently blocks every data: URL inside SVG attributes (href, xlink:href, etc.) as a conservative default. That's the right call for the immediate XSS fix — data:image/svg+xml and data:text/html are real vectors, and dropping them outright avoids whack-a-mole on MIME parsing edge cases.

Per @'s comment (#5514 (comment)), opening this so the narrower whitelist doesn't get forgotten.

What's left to do

Wire a url_filter (or equivalent attribute callback) into the sanitizer so the scheme check can distinguish safe raster MIME types from script-capable ones:

• allow: data:image/png, data:image/jpeg, data:image/gif, data:image/webp
• keep blocking: data:image/svg+xml, data:text/html, data:application/*, anything ambiguous
• keep blocking: javascript:, vbscript:, plain data: with no MIME, MIME with stray whitespace/control chars

Why it's worth doing later (not now)

In ADK today, raster artifacts surface as their own image/* blobs rather than embedded inside SVG, so the current block doesn't degrade the dev UI. But once user-supplied SVGs from external sources show up (e.g., LLM-generated diagrams that inline a small PNG legend), the strict block will start cutting legitimate content. Better to land the relaxation behind a tested filter than to loosen the regex under pressure.

Suggested tests

# allow
assert sanitize('<svg><image href="data:image/png;base64,iVBORw0K..."/></svg>')  # preserved

# block
assert 'data:' not in sanitize('<svg><image href="data:image/svg+xml;base64,..."/></svg>')
assert 'data:' not in sanitize('<svg><image href="data:text/html,<script>alert(1)</script>"/></svg>')
assert 'data:' not in sanitize('<svg><image href="data:image/png ;base64,..."/></svg>')  # stray space