web: PDF preview blocked by CSP (missing frame-src/object-src) #52591

Summary

PDF preview in the web UI renders This content is blocked. Contact the site owner to fix the issue. inside the preview iframe instead of the PDF.

Environment

• opencode version: 2.0.21
• OS: Linux omarchy 7.2.5-3-omarchy feat: compact and other improvements #1 SMP PREEMPT_DYNAMIC Mon, 14 Sep 2026 19:55:01 +0000 x86_64 GNU/Linux
• Terminal: xterm-256color
• Shell: /usr/bin/fish
• Install/channel: latest
• Active plugins: none found in config

Reproduction

1. Start the web UI (opencode serve / background service, e.g. http://127.0.0.1:4096).
2. Open a PDF via file preview (attachment / file viewer preview mode).
3. Observe the preview iframe.

Expected Behavior

PDF renders inside the preview iframe.

Actual Behavior

Iframe shows:

This content is blocked. Contact the site owner to fix the issue.

Additional Context

Not X-Frame-Options — GET / returns no X-Frame-Options header. It returns this Content-Security-Policy (same on /_assets/*):

default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-...'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; media-src 'self' data:; connect-src * data: blob:

There is no frame-src / child-src / object-src / worker-src, so a blob:/data: PDF URL in an iframe falls back to default-src 'self' and is blocked. Chrome's PDF viewer then shows the generic "content is blocked" message.

Likely fix: add e.g. frame-src 'self' blob: data:; object-src 'self' blob: data:; worker-src 'self' blob: to the web-UI CSP.

Reproducible consistently. No workaround tried.