[attr-security.html]
  ['--x: attr(data-foo type(<url>))' with data-foo="url(https://does-not-exist.test/404.png)"]
    expected: FAIL