Allow blob: frames in CSP for in-page PDF previews#126
Conversation
The PDF Number Extractor's viewer modal frames a URL.createObjectURL() blob of the user's own file; frame-src 'self' blocked it. blob: frames only ever contain content the page itself created — no external origin can be framed through this. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Content-Security-Policy in vercel.json to allow blob: sources within the frame-src directive. The reviewer noted that to successfully render PDFs in an iframe on Chromium-based browsers, the object-src directive must also be relaxed from 'none' to 'self' blob:, and provided a code suggestion to resolve this issue.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
1 participant
https://cadautoscript.com/utilities/pdf-number-extractor/ could not open its PDF preview:
Cause:
PdfViewerModalrenders the user's own uploaded PDF viaURL.createObjectURL()in an<iframe>(src/components/PdfNumberExtractor/components/PdfViewerModal.tsx), andframe-srcdid not include theblob:scheme.Fix: add
blob:toframe-src. This is a narrow relaxation: ablob:URL can only reference data the page itself created in memory — it cannot be used to frame any external origin. All other directives unchanged.Also benefits PDF Master / PDF Batch Signer if they ever preview via blob frames.
🤖 Generated with Claude Code