Index: trunk/src/com/kitfox/svg/ImageSVG.java
===================================================================
--- trunk/src/com/kitfox/svg/ImageSVG.java	(revision 11526)
+++ trunk/src/com/kitfox/svg/ImageSVG.java	(revision 14328)
@@ -115,9 +115,23 @@
             {
                 URI src = sty.getURIValue(getXMLBase());
-                // CVE-2017-5617: Allow only data scheme
                 if ("data".equals(src.getScheme()))
                 {
                     imageSrc = new URL(null, src.toASCIIString(), new Handler());
                 }
+                else 
+                {
+                    if (!diagram.getUniverse().isImageDataInlineOnly())
+                    {
+                        try
+                        {
+                            imageSrc = src.toURL();
+                        } catch (Exception e)
+                        {
+                            Logger.getLogger(SVGConst.SVG_LOGGER).log(Level.WARNING,
+                                "Could not parse xlink:href " + src, e);
+                            imageSrc = null;
+                        }
+                    }
+                }
             }
         } catch (Exception e)
@@ -126,31 +140,28 @@
         }
 
-        if (imageSrc != null)
-        {
-            diagram.getUniverse().registerImage(imageSrc);
-
-            //Set widths if not set
-            BufferedImage img = diagram.getUniverse().getImage(imageSrc);
-            if (img == null)
-            {
-                xform = new AffineTransform();
-                bounds = new Rectangle2D.Float();
-                return;
-            }
-
-            if (width == 0)
-            {
-                width = img.getWidth();
-            }
-            if (height == 0)
-            {
-                height = img.getHeight();
-            }
-
-            //Determine image xform
+        diagram.getUniverse().registerImage(imageSrc);
+
+        //Set widths if not set
+        BufferedImage img = diagram.getUniverse().getImage(imageSrc);
+        if (img == null)
+        {
             xform = new AffineTransform();
-            xform.translate(this.x, this.y);
-            xform.scale(this.width / img.getWidth(), this.height / img.getHeight());
-        }
+            bounds = new Rectangle2D.Float();
+            return;
+        }
+
+        if (width == 0)
+        {
+            width = img.getWidth();
+        }
+        if (height == 0)
+        {
+            height = img.getHeight();
+        }
+
+        //Determine image xform
+        xform = new AffineTransform();
+        xform.translate(this.x, this.y);
+        xform.scale(this.width / img.getWidth(), this.height / img.getHeight());
 
         bounds = new Rectangle2D.Float(this.x, this.y, this.width, this.height);
@@ -326,12 +337,14 @@
                 URI src = sty.getURIValue(getXMLBase());
 
-                URL newVal = null;
-                // CVE-2017-5617: Allow only data scheme
+                URL newVal;
                 if ("data".equals(src.getScheme()))
                 {
                     newVal = new URL(null, src.toASCIIString(), new Handler());
+                } else
+                {
+                    newVal = src.toURL();
                 }
 
-                if (newVal != null && !newVal.equals(imageSrc))
+                if (!newVal.equals(imageSrc))
                 {
                     imageSrc = newVal;