search

Mawi137 / ngx-image-cropper

An image cropper for Angular
MIT License
774 stars 207 forks source link

Usage of `data:` regarding Content Security Policy (CSP) #620

Open Basssiiie opened 6 months ago

Basssiiie commented 6 months ago

Hello,

We are using the image cropper in our applications and are running into an issue with our Content Security Policy. We'd like to restrict the usage of data: as it is considered an insecure protocol, but the image cropper does not like this because it contains a hardcoded image inside a data: base64 string here.

For reference, from here:

data: Allows data: URLs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URLs. Use this sparingly and definitely not for scripts.

Would it be possible to have this replaced with a safer alternative so the usage of data: can be completely banned from our applications?

Thank you very much for your time. 🙂

Mawi137 commented 4 months ago

Hi

By default the image is set to an empty pixel, I don't know anymore why that is. So we can try to remove it. Feel free to try it out and open a PR.