Custom Stylesheet: Inline images get corrupted on save

[edda]

I'm trying to add inline images to my custom stylesheet. However whenever I save the custom stylesheet some post processing is done to it which breaks the CSS.

base64 encoded images:
the "data:image/type;base64" part is removed

Example:

.test {
  background: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAAPUlEQVQ4jWP8////fwYqAiZqGjY0DGRBF2CsR+X/byRNfvB7meoGMo6mQ4oBCwMDZtoiF/xvHI3lUQPJAgB/oBIeuc7UeAAAAABJRU5ErkJggg==") no-repeat;
}

after save looks like this:

.test {
  background: url([removed]iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAAPUlEQVQ4jWP8////fwYqAiZqGjY0DGRBF2CsR+X/byRNfvB7meoGMo6mQ4oBCwMDZtoiF/xvHI3lUQPJAgB/oBIeuc7UeAAAAABJRU5ErkJggg==") no-repeat;
}

URL-encoded SVG:
URL-encoded inline SVGs are decoded:

Example:

.test {
  background: url("data:image/svg+xml;charset=utf-8,%3Csvg%20id%3D%22Layer_1%22%20data-name%3D%22Layer%201%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20x%3D%220%22%20y%3D%220%22%20width%3D%226%22%20height%3D%2210%22%20viewBox%3D%220%200%205.67%209.93%22%3E%3Ctitle%3Eangle-right-outline%3C%2Ftitle%3E%3Cpolyline%20points%3D%220.35%200.35%204.96%204.96%200.35%209.58%22%20fill%3D%22none%22%20stroke%3D%22%23008fcc%22%20stroke-miterlimit%3D%2210%22%2F%3E%3C%2Fsvg%3E") no-repeat;
}

after save looks like this:

.test {
  background: url("data:image/svg+xml;charset=utf-8,<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" x="0" y="0" width="6" height="10" viewBox="0 0 5.67 9.93"><title>angle-right-outline</title><polyline points="0.35 0.35 4.96 4.96 0.35 9.58" fill="none" stroke="#008fcc" stroke-miterlimit="10"></svg>") no-repeat;
}

In both cases the resulting CSS is invalid and no image is rendered :(

[jbrooksuk]

I believe this issue is solved now.

[hensur]

I just faced the same issue with cachet 2.4 (sources from today) inside the docker image.
I guess it is because of Binput, which is used in the SettingsController.php.
The "malicious" code, which is the data uri, probably gets removed?