cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: add blob: to CSP frame-src and media-src for PDF/video viewing

Browse Source 
- frame-src: add 'blob:' (wildcard * only matches network schemes)
- media-src: new directive with 'self' blob: (was falling back to default-src)
- Fixes: PDFs blocked in iframe, videos blocked by media-src fallback
This commit is contained in:
Diocrafts
2026-03-07 18:17:35 +01:00
parent 6b02c10942
commit 03c051f9d8
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main.rs
+5 -3
View File
@@ -413,16 +413,18 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
HeaderName::from_static("content-security-policy"), HeaderName::from_static("content-security-policy"),
// All inline scripts and styles have been migrated to external // All inline scripts and styles have been migrated to external
// files, so 'unsafe-inline' is no longer needed. // files, so 'unsafe-inline' is no longer needed.
// frame-src is permissive (*) to allow WOPI editor iframes whose // frame-src: '*' only matches network schemes, so 'blob:' must be
// origin is configured at runtime (Collabora, OnlyOffice, etc.). // listed explicitly for inline PDF/document viewers.
// media-src: needed for blob: video/audio playback.
HeaderValue::from_static( HeaderValue::from_static(
"default-src 'self'; \ "default-src 'self'; \
script-src 'self'; \ script-src 'self'; \
style-src 'self'; \ style-src 'self'; \
img-src 'self' data: blob:; \ img-src 'self' data: blob:; \
media-src 'self' blob:; \
connect-src 'self'; \ connect-src 'self'; \
font-src 'self' data:; \ font-src 'self' data:; \
frame-src *; \ frame-src * blob:; \
frame-ancestors 'none'; \ frame-ancestors 'none'; \
base-uri 'self'; \ base-uri 'self'; \
form-action 'self'", form-action 'self'",