[css-values-5] Ban attr(... type(<url>)) entirely for now. #5079

Author: tabatkins

css-values-5/Overview.bs

@@ -1941,9 +1941,15 @@ Ian's proposal:
 		If given as a ''type()'' function,
 		the value is parsed according to the <<syntax>> argument,
 		and substitutes as the resulting tokens.
+		For this purpose, ''&lt;url>'' is invalid as a <<syntax-single-component>>.
 		Values that fail to parse according to the syntax
 		trigger fallback.
 
+		Note: ''&lt;url>'' is banned because,
+		for now,
+		''attr()'' values can't be used in URLs at all
+		due to security concerns.
+
 		If given as the <css>number</css> keyword,
 		it causes the attribute's literal value,
 		after [=strip leading and trailing ASCII whitespace|stripping leading and trailing whitespace=],