Repository navigation
fix(cli): allow blob frames and objects in web UI CSP - #52948
Serenity-2026 wants to merge 1 commit into
Conversation
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
|
The following comment was made by an LLM, it may be inaccurate: |
The web UI CSP has no frame-src or object-src directive, so blob: iframes and objects fall back to default-src 'self' and are blocked. Desktop is built from v2 and serves the CSP from this file, so blob: previews (icons, PDFs) stay blocked there. Add frame-src 'self' blob: and object-src 'self' blob: next to the existing worker-src, and assert both in the web UI test. Closes anomalyco#50828
31378c1 to
e5f06e2
Compare
|
Rebased onto the current
Test assertions updated for both directives. |
|
Still waiting for this fix, cant look at HTML Files |
|
Automated PR Cleanup Thank you for contributing to opencode. Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions. This PR was closed because it matched the following cleanup criteria:
PRs created within the last month are not affected by this cleanup. If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate. Thanks again for taking the time to contribute. |
Issue for this PR
Closes #50828
Type of change
What does this PR do?
The v2 web UI CSP (
packages/cli/src/services/web-ui.ts) has noframe-srcorobject-srcdirective, soblob:iframes and objects fall back todefault-src 'self'and are blocked. Desktop is built fromv2and serves the CSP from this file, so blob: previews (icons, PDFs) stay blocked there even after thedevfix in #51636. Addedframe-src 'self' blob:andobject-src 'self' blob:.How did you verify your code works?
Extended the existing
packages/cli/test/web-ui.test.tsCSP assertions to cover both directives. Frompackages/cli:bun test test/web-ui.test.ts(2 pass, 74 assertions) andbun run typecheck.Screenshots / recordings
CSP header change:
before:
... media-src 'self' data:; connect-src * data: blob:after:
... media-src 'self' data:; frame-src 'self' blob:; object-src 'self' blob:; connect-src * data: blob:Checklist
If you do not follow this template your PR will be automatically rejected.