From: Alex Gleason <alex@alexgleason.me>
Date: Fri, 29 May 2020 15:33:31 +0000 (-0500)
Subject: Add blob: to connect-src CSP
X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=d38f28870e7ba1c8c1b315d52e68a83fb1a68b6d;p=akkoma

Add blob: to connect-src CSP
---

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dabc2a85a..839bf90ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Fix follower/blocks import when nicknames starts with @
 - Filtering of push notifications on activities from blocked domains
 - Resolving Peertube accounts with Webfinger
+- `blob:` urls not being allowed by connect-src CSP
 
 ## [Unreleased (patch)]
 
diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
index 2208d1d6c..41e3a31f4 100644
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -78,7 +78,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
         {img_src, media_src}
       end
 
-    connect_src = ["connect-src 'self' ", static_url, ?\s, websocket_url]
+    connect_src = ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
 
     connect_src =
       if Pleroma.Config.get(:env) == :dev do