Text data URLs with uppercase BASE64 markers expose encoded payloads

Description

Text attachments using an uppercase or mixed-case base64 flag are not decoded in the session prompt path. The shared data-URL helper checks for the exact lowercase substring ;base64; when it receives data:text/plain;BASE64,SGVsbG8=, it falls through to percent-decoding and returns the literal text SGVsbG8= instead of Hello.

The Fetch Standard's data-URL processor matches the base64 flag ASCII case-insensitively. The helper should parse semicolon-delimited metadata and recognize an exact base64 token without regard to casing.

Reference: https://fetch.spec.whatwg.org/#data-url-processor

This is distinct from #47538, which concerns uppercase DATA: schemes during V2 media normalization. This report concerns the BASE64 flag in server-side text attachment decoding.

Plugins

N/A

OpenCode version

N/A (reproduced in the shared data-URL helper)

Steps to reproduce

1. Evaluate decodeDataUrl("data:text/plain;BASE64,SGVsbG8=").
2. Observe that it returns SGVsbG8=.
3. Repeat with the lowercase marker data:text/plain;base64,SGVsbG8= and observe that it returns Hello.

Expected behavior: both casing variants should return Hello.

Screenshot and/or share link

Not provided; the helper call above is the deterministic reproduction.

Operating System

All

Terminal

All