From bb7251bd259bba4886c84ff4ad08e0c9dc8885a0 Mon Sep 17 00:00:00 2001
From: fen <fen@archfox.org>
Date: Thu, 10 Sep 2026 11:37:39 -0500
Subject: [PATCH] Fix #171 (r2): file image preview uses data: URL (FileReader)
 instead of blob: for CSP compliance

---
 internal/web/static/new.js | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/internal/web/static/new.js b/internal/web/static/new.js
index bee7ce8..349317d 100644
--- a/internal/web/static/new.js
+++ b/internal/web/static/new.js
@@ -258,12 +258,19 @@ async function showFileInEditor(file) {
   const wrap = document.querySelector('.editor-wrap');
   const img = $('file-preview');
   if (IMAGE_RE.test(file.type)) {
+    // CSP-safe: img-src only allows 'self' data:, so use a data: URL
+    // (FileReader.readAsDataURL) instead of blob: object URLs. #171
     if (previewURL) URL.revokeObjectURL(previewURL);
-    previewURL = URL.createObjectURL(file);
-    img.src = previewURL;
-    img.alt = file.name;
-    wrap.classList.add('previewing');
-    img.classList.remove('hidden');
+    previewURL = null;
+    const reader = new FileReader();
+    reader.onload = () => {
+      previewURL = reader.result;
+      img.src = previewURL;
+      img.alt = file.name;
+      wrap.classList.add('previewing');
+      img.classList.remove('hidden');
+    };
+    reader.readAsDataURL(file);
     return;
   }
   wrap.classList.remove('previewing');
-- 
2.54.0