search

newinternetlabs / new-internet-extension

https://newinternetextension.com
Other
14 stars 4 forks source link

Allow blob: URLs as content source #15

Closed ViniciusBP closed 4 years ago

ViniciusBP commented 4 years ago

The connect-src directive is configured as a wildcard and allow any URLs with a network scheme. 

Why is not allowed to use blob: URIs as content source? I think it should be changed to allow.

alansoliditydev commented 4 years ago

I have this problem, too

thiagomva commented 4 years ago

I'm having this problem with connect-src and also with object-src directive. I think both should allow blob content.

GinaAbrams commented 4 years ago

@larrysalibra would you be able to please comment on this one 🙏

larrysalibra commented 4 years ago

@ViniciusBP I'm open to making changes to it. Do you want to send a pull request with the proposed changes?

Alternatively, could you write the CSP expression as you'd like to see it here in the issue? Thanks!

thiagomva commented 4 years ago

@larrysalibra just created a pull request changing: connect-src to connect-src data: blob:; object-src 'self' to object-src 'self' data: blob:;

larrysalibra commented 4 years ago

This already was merged and shipped.