vrr/opencode
2
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-08-07 04:23:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

fix(server): allow blob attachments in web UI (#40692)

Browse source
This commit is contained in:
mridul 2026-08-06 03:53:32 +05:30 • committed by GitHub
parent ebf6fc07a1
commit 23bbc5cd14
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/opencode/src/server/shared/ui.ts
View file

@ -9,7 +9,7 @@ let embeddedUIPromise: Promise<Record<string, string> | null> | undefined
export const UI_UPSTREAM = new URL("https://app.opencode.ai")
export const csp = (hash = "") =>
`default-src 'self'; script-src 'self' 'wasm-unsafe-eval'${hash ? ` 'sha256-${hash}'` : ""}; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; media-src 'self' data:; connect-src * data:`
`default-src 'self'; script-src 'self' 'wasm-unsafe-eval'${hash ? ` 'sha256-${hash}'` : ""}; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; media-src 'self' data:; connect-src * data: blob:`
export const DEFAULT_CSP = csp()
export function themePreloadHash(body: string) {

5
packages/opencode/test/server/httpapi-ui.test.ts
View file

@ -326,7 +326,7 @@ describe("HttpApi UI fallback", () => {
}),
)
it.live("allows embedded UI terminal wasm and theme preload CSP", () =>
it.live("allows embedded UI terminal wasm, blob attachments, and theme preload CSP", () =>
Effect.gen(function* () {
const script = 'document.documentElement.dataset.theme = "dark"'
@ -351,7 +351,8 @@ describe("HttpApi UI fallback", () => {
const csp = response.headers.get("content-security-policy") ?? ""
expect(csp).toContain("script-src 'self' 'wasm-unsafe-eval'")
expect(csp).toContain(`'sha256-${createHash("sha256").update(script).digest("base64")}'`)
expect(csp).toContain("connect-src * data:")
expect(csp).toContain("img-src 'self' data: https: blob:")
expect(csp).toContain("connect-src * data: blob:")
}),
)