From 03c051f9d8f08307572926dd094c4435ff9a1609 Mon Sep 17 00:00:00 2001 From: Diocrafts Date: Sat, 7 Mar 2026 18:17:35 +0100 Subject: [PATCH] fix: add blob: to CSP frame-src and media-src for PDF/video viewing - frame-src: add 'blob:' (wildcard * only matches network schemes) - media-src: new directive with 'self' blob: (was falling back to default-src) - Fixes: PDFs blocked in iframe, videos blocked by media-src fallback --- src/main.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/main.rs b/src/main.rs index 711e489e..0048b984 100755 --- a/src/main.rs +++ b/src/main.rs @@ -413,16 +413,18 @@ async fn main() -> Result<(), Box> { HeaderName::from_static("content-security-policy"), // All inline scripts and styles have been migrated to external // files, so 'unsafe-inline' is no longer needed. - // frame-src is permissive (*) to allow WOPI editor iframes whose - // origin is configured at runtime (Collabora, OnlyOffice, etc.). + // frame-src: '*' only matches network schemes, so 'blob:' must be + // listed explicitly for inline PDF/document viewers. + // media-src: needed for blob: video/audio playback. HeaderValue::from_static( "default-src 'self'; \ script-src 'self'; \ style-src 'self'; \ img-src 'self' data: blob:; \ + media-src 'self' blob:; \ connect-src 'self'; \ font-src 'self' data:; \ - frame-src *; \ + frame-src * blob:; \ frame-ancestors 'none'; \ base-uri 'self'; \ form-action 'self'",