From f947415b23ad2d337006397de381ef76b5680dd8 Mon Sep 17 00:00:00 2001
From: fen <fen@archfox.org>
Date: Thu, 10 Sep 2026 11:38:22 -0500
Subject: [PATCH] fix #171: use FileReader data: URL for image preview (CSP
 blocks blob:)

---
 internal/web/static/new.js | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/internal/web/static/new.js b/internal/web/static/new.js
index bee7ce8..1ce5147 100644
--- a/internal/web/static/new.js
+++ b/internal/web/static/new.js
@@ -254,16 +254,25 @@ function extOf(name) {
 const IMAGE_RE = /^image\//;
 let previewURL = null;
 
+// #171: CSP img-src only allows 'self' and data:, so blob: URLs are
+// blocked — read the file as a data: URL via FileReader instead.
+function readFileDataURL(file, cb) {
+  const r = new FileReader();
+  r.onload = () => cb(r.result);
+  r.readAsDataURL(file);
+}
+
 async function showFileInEditor(file) {
   const wrap = document.querySelector('.editor-wrap');
   const img = $('file-preview');
   if (IMAGE_RE.test(file.type)) {
-    if (previewURL) URL.revokeObjectURL(previewURL);
-    previewURL = URL.createObjectURL(file);
-    img.src = previewURL;
-    img.alt = file.name;
-    wrap.classList.add('previewing');
-    img.classList.remove('hidden');
+    readFileDataURL(file, (dataURL) => {
+      previewURL = dataURL;
+      img.src = dataURL;
+      img.alt = file.name;
+      wrap.classList.add('previewing');
+      img.classList.remove('hidden');
+    });
     return;
   }
   wrap.classList.remove('previewing');