fix(css): correct attr() restriction in url-taking functions

[samson1299]

Fixes #44030

The current docs incorrectly state that attr() can work inside image-set().
Per the CSS Values 5 spec (attr-taint), attr() is forbidden in any function
that could produce a <url>, including image-set() and image().

[github-actions]

Preview URLs (1 page)

• /en-US/docs/Web/CSS/Reference/Values/attr

Flaws (3)

Found an unexpected or unresolvable flaw? Please report it here.

URL: /en-US/docs/Web/CSS/Reference/Values/attr
Title: attr() CSS function
Flaw count: 3

• macros:
  • Macro csssyntax produces link /en-US/docs/Web/CSS/Reference/Values/declaration-value which doesn't resolve
  • Macro csssyntax produces link /en-US/docs/Web/CSS/Reference/Values/ident-token which doesn't resolve
  • Macro csssyntax produces link /en-US/docs/Web/CSS/Reference/Values/ident-token which doesn't resolve

External URLs (1)

URL: /en-US/docs/Web/CSS/Reference/Values/attr
Title: attr() CSS function

• https://www.bram.us/2024/02/26/css-what-is-iacvt/ (3 times) (Note! This may be a new URL 👀)

(comment last updated: 2026-06-29 02:52:00)

[hamishwillee]

Thanks @samson1299

This was good. Note again though, you took an issue that is not triaged according to its label - it could have been incorrect. If you're going to take such an issue it would be good to explain why you trust it.

I've subedited a little. What you did was certainly acceptable - I wanted to make sure we mentioned the tainting first.