[Chen Yufeiyang (feiiiiii5)]

Motivation and Context

Valid RFC 2397 data URIs are rejected or silently mis-decoded when the media type contains + (for example image/svg+xml) or when a parameter precedes base64 (for example data:text/plain;charset=utf-8;base64,...).

ImageContent(data_uri="data:image/svg+xml;base64,PHN2Zy8+") raises ContentInitializationError: Invalid data uri format. DataUri.from_data_uri("data:text/plain;charset=utf-8;base64,SGVsbG8=") does not raise, but returns the base64 text as bytes instead of decoding it, because charset=utf-8;base64 is treated as one data-format string. Both are valid data URIs, and the second is a silent data-corruption path.

Description

The parser now uses RFC 6838/RFC 2045 token characters for the media type and parameters, and keeps the optional data format as a token. This accepts image/svg+xml, vendor types such as application/vnd.ms-excel, and ;charset=utf-8;base64 without treating the parameter as part of the base64 marker.

Tests added for the media-type +, a parameter before base64, a vendor media type, and ImageContent construction from an SVG data URI. On the base commit 483ffb4, the four new tests fail; on this branch the related contents/prompt/template/text suites are 1,111 passed. ruff check and ruff format --check are clean.

Contribution Checklist

• The code builds clean without any errors or warnings (imports and targeted unit suites).
• The PR follows the SK contribution guidelines; ruff check and ruff format --check pass on the changed files.
• All targeted unit tests pass, and new regression tests were added.
• No breaking change for existing valid data URIs; quoted-string parameters remain out of scope.

[Copilot]

🟡 Changes recommended

The revised parser rejects valid parameter characters and shorthand URIs that omit the media type.

2 open issues

• Allow omitted MIME type with parameters in data URIs · New
• Use RFC 2045 parameter-token alphabet for data URI parameters · New

What changed in this PR

This PR updates Python’s data URI parser to accept additional media-type characters and correctly separate parameters from the base64 marker.

Changes:

• Expands the parser’s media-type and parameter character classes.
• Adds regression tests for SVG, vendor media types, and charset parameters before base64.
• Tests ImageContent construction from an SVG data URI.

File	Description
python/​tests/​unit/​contents/​test_image_content.py	Adds SVG data URI construction coverage.
python/​tests/​unit/​contents/​test_data_uri.py	Adds media-type and parameter parsing cases.
python/​semantic_kernel/​contents/​utils/​data_uri.py	Revises the data URI parsing expression.

_{Review effort: Balanced}

[Eduard van Valkenburg (eavanvalkenburg)]

The current pre-commit job fails on this assignment with Bandit B105:hardcoded_password_string (https://github.com/microsoft/semantic-kernel/actions/runs/40984502209). This is a false positive: the value is a regex, not a credential, but the variable name parameter_token triggers the check. Please rename it to something like parameter_pattern so the existing hook passes without weakening the security checks.

[Chen Yufeiyang (feiiiiii5)]

Done — renamed the local regex variable to parameter_pattern (both the definition and the two references in the f-string). Bandit B105 no longer fires; I left the token alphabet and behavior unchanged and did not add # nosec. Verified locally with the same pre-commit hook (bandit passes) and pytest tests/unit/contents/test_data_uri.py (48 passed).