[Security]: Convert base64-data-image-url to blob-url without using fetch! - Githubissues

Cordobo / angularx-qrcode

A fast and easy-to-use Angular QR Code Generator library with Ivy support

https://cordobo.github.io/angularx-qrcode/

MIT License

469 stars 125 forks source link

[Security]: Convert base64-data-image-url to blob-url without using fetch! #255

Closed amazing4u closed 2 months ago

amazing4u commented 3 months ago

Hi @Cordobo

Thank you for this great library!

Until now the user needs to enable connect-src for data: and weaken the security!

With this change i convert the base64-data-image-url in a blob-url without using fetch so you don't need to change the csp for connect-src!

More information: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

This fixes #196