Fix #171 (r2): file image preview uses data: URL (FileReader) instead of blob: for CSP compliance

2026-09-10 11:37:39 -05:00
parent 362a59690f
commit bb7251bd25
1 changed files with 12 additions and 5 deletions
@@ -258,12 +258,19 @@ async function showFileInEditor(file) {
  const wrap = document.querySelector('.editor-wrap');
  const img = $('file-preview');
  if (IMAGE_RE.test(file.type)) {
+    // CSP-safe: img-src only allows 'self' data:, so use a data: URL
+    // (FileReader.readAsDataURL) instead of blob: object URLs. #171
    if (previewURL) URL.revokeObjectURL(previewURL);
-    previewURL = URL.createObjectURL(file);
+    previewURL = null;
+    const reader = new FileReader();
+    reader.onload = () => {
+      previewURL = reader.result;
      img.src = previewURL;
      img.alt = file.name;
      wrap.classList.add('previewing');
      img.classList.remove('hidden');
+    };
+    reader.readAsDataURL(file);
    return;
  }
  wrap.classList.remove('previewing');