Post

That said, if the concern is only about attackers (able to inject CSS) being able to access secrets, could the attribute in the HTML be explicitly marked up to say the value can be used by CSS, e.g. <article data-bg=“url(/path/img.jpg)”>