[attestations 3] Accept inline data:image/svg+xml in image_url

[mdgeorge4153]

Frontend counterpart to the attestations repo's inline-SVG CONVENTIONS.md change (MystenLabs/attestations#4). First PR in the source-verification stack; stacked on #245 (base mdgeorge/attestation-grpc).

Problem

The attestation badge fed image_url through httpsLink, which only accepts https://. So an inline data:image/svg+xml badge — the point of the convention change — was silently dropped and fell back to the attester avatar.

Change

• New imageSource helper: accepts an https URL or a data:image/svg+xml URI (raw, ;base64,, and ;charset=…, forms). Used only for the badge.
• The report link keeps httpsLink (https-only) — a data: link target isn't wanted.

Safety

The value goes only into an <img src>, where a <script> or onload inside the SVG does not execute — which is the rule the convention spells out (render in <img>, never inline into the DOM). Rejected: http, other data: types (data:text/html,…), prefix-spoofs (data:image/svg+xmlEVIL), javascript:.

Verification

TSC clean; the accept/reject logic is unit-checked against the cases above. Not yet visually confirmed against a real attestation — none of the testnet attesters set image_url yet (that's exactly the source-verification badge work coming next in the stack).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GqiELJtBuhYBp2W35ExHCk

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mvr	Ready	Preview	Aug 20, 2026 11:07am