Skip to content

fix(web): let the page show blob: images, so attached pictures get thumbnails - #116

Merged
brianjfox merged 1 commit into
mainfrom
fix/csp-blob-images
Nov 3, 2026
Merged

brianjfox merged 1 commit into
mainfrom
fix/csp-blob-images

Conversation

@brianjfox

@brianjfox brianjfox commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Closes #117

What

The page's Content Security Policy allows blob: images, so a picture attached to a message shows as a thumbnail.

Why

The attachment components in @corbits/react-ui preview a picture from an object URL made with URL.createObjectURL, a blob: URL. The policy in apps/web/index.html allowed 'self' and data: only, so the browser blocked every preview and the kit fell back to the file's type. Details in #117.

Changes

  • apps/web/index.html: img-src gains blob:.

…umbnails

The attachment components preview a picture from an object URL, which is a blob: URL the page's Content Security Policy did not allow, so every attached picture showed as its type instead.
@brianjfox
brianjfox merged commit b0fa953 into main Nov 3, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Attached pictures show no thumbnail: the page's Content Security Policy blocks blob: images

1 participant