Repository navigation
fix(opencode): allow blob frames and objects in embedded UI CSP - #51636
Serenity-2026 wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
needs:compliance
|
The following comment was made by an LLM, it may be inaccurate: |
github-actions
Bot
removed
the
needs:compliance
|
Thanks for updating your PR! It now meets our contributing guidelines. 👍 |
The embedded web UI CSP had no frame-src or object-src directive, so blob: iframes and objects fell back to default-src 'self' and were blocked. The icon renderer frames blob: URLs (icons showed the browser's blocked placeholder), and PDF previews are affected the same way. Add frame-src 'self' blob: and object-src 'self' blob:. Closes anomalyco#50828
d02f9c5 to
cbaf017
Compare
|
Done — added |
Serenity-2026
changed the title
|
Confirmed the second copy is v2-only — |
|
This branch has been upgraded to V2. We're no longer taking PRs for V1. If you think this is still relevant, please port it over and open it for V2. — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊 |
|
Covered by #52948, which is now based on |
Issue for this PR
Closes #50828
Type of change
What does this PR do?
The embedded web UI CSP had no
frame-srcorobject-srcdirective, soblob:iframes and objects fell back todefault-src 'self'and were blocked. The icon renderer framesblob:URLs, so affected icons showed the browser's blocked-content placeholder; PDF previews are blocked the same way (#52591). Addedframe-src 'self' blob:andobject-src 'self' blob:.img-srcandconnect-srcalready allowedblob:.How did you verify your code works?
Added
packages/opencode/test/server/ui-csp.test.tsasserting the generated policy (with and without a theme-preload hash) contains both directives. Frompackages/opencode:bun test test/server/ui-csp.test.tsandbun run typecheck.Screenshots / recordings
CSP header change:
before:
... media-src 'self' data:; connect-src * data: blob:after:
... media-src 'self' data:; frame-src 'self' blob:; object-src 'self' blob:; connect-src * data: blob:Checklist
If you do not follow this template your PR will be automatically rejected.