From afe1e5a67cb2bc8d3489a3a71d49e380ff0cf679 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 23 May 2026 15:53:58 +0200
Subject: [PATCH] fix: restore blob: in object-src and frame-src CSP for
 PDF/HTML previews

---
 proxy.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/proxy.ts b/proxy.ts
index 814abbd5..26fc1dcb 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -97,8 +97,8 @@ export async function proxy(request: NextRequest) {
   const pluginFrameOrigins = await getEnabledPluginFrameOrigins();
   const frameSrc =
     pluginFrameOrigins.length > 0
-      ? `frame-src 'self' ${pluginFrameOrigins.join(" ")}`
-      : `frame-src 'self'`;
+      ? `frame-src 'self' blob: ${pluginFrameOrigins.join(" ")}`
+      : `frame-src 'self' blob:`;
 
   const csp = [
     `default-src 'self'`,
@@ -108,7 +108,7 @@ export async function proxy(request: NextRequest) {
     `font-src 'self'`,
     `connect-src ${connectSrc}`,
     frameSrc,
-    `object-src 'none'`,
+    `object-src 'self' blob:`,
     `base-uri 'self'`,
     `form-action 'self'`,
     `frame-ancestors ${frameAncestors}`,