Skip to content

Conversation

igzThomasFrischholz
Copy link

URLListValidator did not support Object-URLs which lead to misbehaviour in some classes. (e.g PDFViewer could not load files from object urls)

This PR aims to fix this issue by adding a regex check and decompose into the validate method of URLListValidator.js
A separate Unit-Test for the desired behavior has been added as well.

Copy link

cla-assistant bot commented May 23, 2024

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@flovogt
Copy link
Member

flovogt commented May 23, 2024

Thanks a lot for your PR. The team will have a look at it!
Internally tracked via DINC0162093.

@boghyon
Copy link
Contributor

boghyon commented May 26, 2024

blob: URLs are generally considered as insecure as unsafe-eval (See w3c/webappsec-csp@0f497cb and https://www.w3.org/TR/CSP2/#source-list-guid-matching) and might not be explicitly allowed by the CSP configuration set in e.g. Fiori launchpad sites.

@flovogt flovogt self-assigned this Feb 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants