poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix #171: use FileReader data: URL for image preview (CSP blocks blob:)
CI / test (pull_request) Successful in 39s
Details
CI / docker (pull_request) Skipped
Details

Browse Source
This commit is contained in:
fen
2026-09-10 11:38:22 -05:00
parent 362a59690f
commit f947415b23
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/static/new.js
+12 -3
View File
@@ -254,16 +254,25 @@ function extOf(name) {
const IMAGE_RE = /^image\//; const IMAGE_RE = /^image\//;
let previewURL = null; let previewURL = null;
// #171: CSP img-src only allows 'self' and data:, so blob: URLs are
// blocked — read the file as a data: URL via FileReader instead.
function readFileDataURL(file, cb) {
const r = new FileReader();
r.onload = () => cb(r.result);
r.readAsDataURL(file);
}
async function showFileInEditor(file) { async function showFileInEditor(file) {
const wrap = document.querySelector('.editor-wrap'); const wrap = document.querySelector('.editor-wrap');
const img = $('file-preview'); const img = $('file-preview');
if (IMAGE_RE.test(file.type)) { if (IMAGE_RE.test(file.type)) {
if (previewURL) URL.revokeObjectURL(previewURL); readFileDataURL(file, (dataURL) => {
previewURL = URL.createObjectURL(file); previewURL = dataURL;
img.src = previewURL; img.src = dataURL;
img.alt = file.name; img.alt = file.name;
wrap.classList.add('previewing'); wrap.classList.add('previewing');
img.classList.remove('hidden'); img.classList.remove('hidden');
});
return; return;
} }
wrap.classList.remove('previewing'); wrap.classList.remove('previewing');