new Image().src = encodeURI('[user url here]');
Let's assume two cases:
[user url here]is some string provided by user (with no validation)
[user url here]is a valid url (validated by Django URLValidator)
I'd imagine there are a lot of vectors for first case, ex.
But what about the second case? Are there any known vectors?
UPDATE: The only vector I can think of is MIME sniffing attack