As a web dev, it’s convenient or even advantageous to embed data URIs into a stylesheet to cut down on request volume (at the expense of slightly heavier traffic loads because base-64-encoded data is far from efficient), improve caching behaviors, or make a style more easily portable since its image assets are entirely self-contained. I certainly wouldn’t use it for huge masthead graphics, but for small things like logos on buttons, icons, or minor backgrounds that still can’t be drawn reliably with CSS3’s built-in capabilities, it’s great. The portability of data URI images also has advantageous applications outside of web development. I’ve also used data URIs to embed images of signatures captured by card reader terminals into an XML-based data export which shuttles transaction data from a POS system to a back-office accounting platform. Without the data URI standard, I’d have to develop some way of gathering the signature images into a supplemental ZIP file, which would increase the complexity of the exported data structure far more than simply base-64-encoding the image data into the export itself.
Besides, automatically loading images out of data URIs isn’t inherently more dangerous than loading images served through more traditional means. Any image delivery mechanism is capable of exploiting vulnerabilities in the browser’s image parsing processes. Until the data in the data URI is actually converted out of base-64 and handed over to an image parser, it’s a completely harmless block of alphanumeric text. Data URIs are only potentially dangerous when parsed, but that’s true of any image; malicious code can be embedded in normal images as well, and the image tag itself can have anything for a source, including PHP or ASP.NET pages capable of generating more targeted image-based exploits based on browser sniffing. I would have to test it, but if your browser has a means for disabling images on web pages, it should disable images loaded from data URIs as well. And for browsers like Safari (which features content blockers that remove elements based on rules before they’re ever even passed to the rendering engine), any CSS rule or HTML tag that can be directly targeted by a blocker rule can be removed from the page before parsing, including ones containing data URIs.
