src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: restore blob: in object-src and frame-src CSP for PDF/HTML previews

Browse Source
This commit is contained in:
Linus Rath
2026-05-23 15:53:58 +02:00
parent d13934c2a6
commit afe1e5a67c
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy.ts
+3 -3
View File
@@ -97,8 +97,8 @@ export async function proxy(request: NextRequest) {
const pluginFrameOrigins = await getEnabledPluginFrameOrigins(); const pluginFrameOrigins = await getEnabledPluginFrameOrigins();
const frameSrc = const frameSrc =
pluginFrameOrigins.length > 0 pluginFrameOrigins.length > 0
? `frame-src 'self' ${pluginFrameOrigins.join(" ")}` ? `frame-src 'self' blob: ${pluginFrameOrigins.join(" ")}`
: `frame-src 'self'`; : `frame-src 'self' blob:`;
const csp = [ const csp = [
`default-src 'self'`, `default-src 'self'`,
@@ -108,7 +108,7 @@ export async function proxy(request: NextRequest) {
`font-src 'self'`, `font-src 'self'`,
`connect-src ${connectSrc}`, `connect-src ${connectSrc}`,
frameSrc, frameSrc,
`object-src 'none'`, `object-src 'self' blob:`,
`base-uri 'self'`, `base-uri 'self'`,
`form-action 'self'`, `form-action 'self'`,
`frame-ancestors ${frameAncestors}`, `frame-ancestors ${frameAncestors}`,