paragonie/csp-builder

Allow adding "blob" as source in JSON

Closed this issue · 3 comments

daniplaninc commented

I would like to do this:

"img-src": {
"self": true,
"data": true,
"blob": true
},

However, the "blob":true has no effect. I can resolve this by adding it in the other way:

$csp->addSource('image-src', "blob:");

but that results in having to look at annoying error messages in the console:
1

As a solution I would also accept any way to remove the automatic addition of "http://blob" and "https://blob" to the source list.

paragonie-scott commented

This is the first I've heard of blob: being a thing. I thought only data: URIs were standard?

daniplaninc commented

I am using Sir Trevor, which stores an image blob on the site temporarily, that is when I get the CSP error:
Refused to load the image 'blob:<image-name>' because it violates the following Content Security Policy directive: "img-src ...

blob: is listed here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src

paragonie-scott commented

Sorry, I missed this somehow.

This will be fixed in v2.3.0, which will be released sometime today.