search

jgraph / docker-drawio

Dockerized draw.io based on whichever is the most secure image at the time.
GNU General Public License v3.0
1.48k stars 359 forks source link

CSP for iframe usage in e.g. outline #132

Open Farnsi opened 9 months ago

Farnsi commented 9 months ago

Try to add CSP-Header with variable DRAWIO_CSP_HEADER frame-ancestors 'self' https://myserver.xyz;, or frame-ancestors *; but none seems to change anything.

Did somebody have an idea?

Add Diagram in Outline works, but as soon as i click "create" i got the error:

 INFO SecurityError undefined undefined undefined DOMException: Failed to execute 'showSaveFilePicker' on 'Window': Cross origin sub frames aren't allowed to show a file picker.
    at App.showSaveFilePicker (https://myserver.xyz/js/app.min.js:13026:288)
    at App.createFile (https://myserver.xyz/js/app.min.js:13056:158)
    at https://myserver.xyz/js/app.min.js:11253:435
    at EditorUi.pickFolder (https://myserver.xyz/js/app.min.js:12029:6)
    at App.pickFolder (https://myserver.xyz/js/app.min.js:13101:364)
    at J (https://myserver.xyz/js/app.min.js:11253:402)
    at https://myserver.xyz/js/app.min.js:11275:353
    at HTMLButtonElement.<anonymous> (https://myserver.xyz/js/app.min.js:196:249)

drawio-outline

BigTows commented 7 months ago

Same issue, image: 23.0.2. DRAWIO_CSP_HEADER goes no effect.

davidjgraph commented 7 months ago

Please write as a full bug report.