poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Merge pull request 'fix #171: CSP-compliant image preview (data: URL instead of blob:)' (#186) from fix-171 into dev
CI / test (push) Successful in 41s
Details
CI / docker (push) Successful in 50s
Details

Browse Source
This commit was merged in pull request #186.
This commit is contained in:
fen
2026-09-10 16:42:15 +00:00
parent 5fa728f276 f947415b23
commit 368620eb15
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/static/new.js
+15 -6
View File
@@ -254,16 +254,25 @@ function extOf(name) {
const IMAGE_RE = /^image\//;
let previewURL = null;
// #171: CSP img-src only allows 'self' and data:, so blob: URLs are
// blocked — read the file as a data: URL via FileReader instead.
function readFileDataURL(file, cb) {
const r = new FileReader();
r.onload = () => cb(r.result);
r.readAsDataURL(file);
}
async function showFileInEditor(file) {
const wrap = document.querySelector('.editor-wrap');
const img = $('file-preview');
if (IMAGE_RE.test(file.type)) {
if (previewURL) URL.revokeObjectURL(previewURL);
previewURL = URL.createObjectURL(file);
img.src = previewURL;
img.alt = file.name;
wrap.classList.add('previewing');
img.classList.remove('hidden');
readFileDataURL(file, (dataURL) => {
previewURL = dataURL;
img.src = dataURL;
img.alt = file.name;
wrap.classList.add('previewing');
img.classList.remove('hidden');
});
return;
}
wrap.classList.remove('previewing');