poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Fix #171 (r2): file image preview uses data: URL (FileReader) instead of blob: for CSP compliance
CI / test (pull_request) Successful in 41s
Details
CI / docker (pull_request) Skipped
Details

Browse Source
This commit is contained in:
fen
2026-09-10 11:37:39 -05:00
parent 362a59690f
commit bb7251bd25
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/static/new.js
+12 -5
View File
@@ -258,12 +258,19 @@ async function showFileInEditor(file) {
const wrap = document.querySelector('.editor-wrap'); const wrap = document.querySelector('.editor-wrap');
const img = $('file-preview'); const img = $('file-preview');
if (IMAGE_RE.test(file.type)) { if (IMAGE_RE.test(file.type)) {
// CSP-safe: img-src only allows 'self' data:, so use a data: URL
// (FileReader.readAsDataURL) instead of blob: object URLs. #171
if (previewURL) URL.revokeObjectURL(previewURL); if (previewURL) URL.revokeObjectURL(previewURL);
previewURL = URL.createObjectURL(file); previewURL = null;
img.src = previewURL; const reader = new FileReader();
img.alt = file.name; reader.onload = () => {
wrap.classList.add('previewing'); previewURL = reader.result;
img.classList.remove('hidden'); img.src = previewURL;
img.alt = file.name;
wrap.classList.add('previewing');
img.classList.remove('hidden');
};
reader.readAsDataURL(file);
return; return;
} }
wrap.classList.remove('previewing'); wrap.classList.remove('previewing');