The idea would be to also block if the response is for an image or plugin, e.g., `data:text/html,<embed src="https://avatars3.githubusercontent.com/u/665379?s=88&v=4">` or `data:text/html,<embed src="https://avatars3.githubusercontent.com/u/665379?s=88&v=4" type="image/jpeg">`, but there are some compatibility risks with doing that so we'd need to roll that out carefully.
Bug 1595762 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The idea would be to also block if the response is for an image or plugin, e.g., `data:text/html,<embed src="https://avatars3.githubusercontent.com/u/665379?s=88&v=4">` or `data:text/html,<embed src="https://avatars3.githubusercontent.com/u/665379?s=88&v=4" type="image/jpeg">`, but there are some compatibility risks with doing that so we'd need to roll that out carefully. (This is now tracked by bug 1596402.)