Problem with text format and base64 inline images I am using Drupal 8.6.13 text field with Full HTML text format for a field where we want to have content with inline base64 images (due to the synchronization with Gather Content).

Synchronization works well and images content is being saved in a Drupal text field but "data:" part is somehow filtered out - most probably by the Text format filter.

Long text field's source content:

&lt;img alt="null" src="data:image/png;base64,...." /&gt;


becomes

&lt;img alt="null" src="image/png;base64,...." /&gt;


after saving.

Limit allowed HTML tags and correct faulty HTML is active for Full HTML text format. We need this to limit heading types. If I disable "Limit allowed HTML tags" option then it works as expected.

Allowed tags are: &lt;a href hreflang&gt; &lt;em&gt; &lt;strong&gt; &lt;cite&gt; &lt;blockquote cite&gt; &lt;code&gt; &lt;ul type class&gt; &lt;ol start type&gt; &lt;li class&gt; &lt;dl&gt; &lt;dt&gt; &lt;dd&gt; &lt;h4 id&gt; &lt;s&gt; &lt;sup&gt; &lt;sub&gt; &lt;img src data alt data-entity-type data-entity-uuid data-align data-caption&gt; &lt;table&gt; &lt;caption&gt; &lt;tbody&gt; &lt;thead&gt; &lt;tfoot&gt; &lt;th&gt; &lt;td&gt; &lt;tr&gt; &lt;hr&gt; &lt;p&gt; &lt;button&gt;

Any idea how to prevent data: from being filtered out of the src attribute of an image tag and keep "Limit allowed HTML tags" option active?
I believe I tracked this down. With the filter formatter you mentioned, it calls Xss::filter() on the text.
Xss::filter() looks at the src attribute and will strip any protocol that have not been allowed. It sees anything XYZ: as a protocol, in this case data:.
I added - data to my docroot/sites/default/services.yml filter_protocols value and stopped the data: from being stripped.
I don't know if this opens any other security concerns or not.