From e7be3d1e0cdf7b125d867421f51807c38690b8d1 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 6 May 2026 00:54:46 +0200
Subject: [PATCH] fix: render PDF previews via <object> with blob: in
 object-src CSP #253

---
 components/files/file-preview-modal.tsx | 15 ++++++++++-----
 proxy.ts                                |  2 +-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/components/files/file-preview-modal.tsx b/components/files/file-preview-modal.tsx
index d751e0a2..f8e295ac 100644
--- a/components/files/file-preview-modal.tsx
+++ b/components/files/file-preview-modal.tsx
@@ -221,12 +221,17 @@ export function FilePreviewModal({ name, onClose, onDownload, getFileContent }:
         )}
 
         {!loading && !error && fileType === "pdf" && objectUrl && (
-          <iframe
-            src={objectUrl}
-            sandbox="allow-scripts"
+          <object
+            data={objectUrl}
+            type="application/pdf"
             className="w-full max-w-5xl h-full rounded-lg bg-white"
-            title={name}
-          />
+            aria-label={name}
+          >
+            <Button onClick={() => void onDownload()}>
+              <Download className="w-4 h-4 mr-2" />
+              {t("download")}
+            </Button>
+          </object>
         )}
 
         {!loading && !error && fileType === "audio" && objectUrl && (
diff --git a/proxy.ts b/proxy.ts
index 5f965480..fed44af2 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -43,7 +43,7 @@ export async function proxy(request: NextRequest) {
     `font-src 'self'`,
     `connect-src ${connectSrc}`,
     frameSrc,
-    `object-src 'none'`,
+    `object-src 'self' blob:`,
     `base-uri 'self'`,
     `form-action 'self'`,
     `frame-ancestors ${frameAncestors}`,