@3sln/trove 0.0.18 → 0.0.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/packages/web/dist/assets/{main-b9jd0fyt.js → main-axerf2vw.js} +3 -3
- package/packages/web/dist/assets/{main-b9jd0fyt.js.map → main-axerf2vw.js.map} +3 -3
- package/packages/web/dist/index.html +1 -1
- package/packages/web/dist/sw.js +1 -1
- package/packages/web/src/platform/pluginRpc.js +14 -1
package/packages/web/dist/sw.js
CHANGED
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
// API and FILES deliberately do NOT rotate. API is data, not code, and FILES holds the
|
|
19
19
|
// bytes of files the user pinned for offline use — naming it per build would throw away
|
|
20
20
|
// someone's offline library every time the app was redeployed.
|
|
21
|
-
const SHELL = 'trove-shell-
|
|
21
|
+
const SHELL = 'trove-shell-7c8b99c0d0';
|
|
22
22
|
const API = 'trove-api-v1';
|
|
23
23
|
const FILES = 'trove-files-v1';
|
|
24
24
|
const KEEP = new Set([SHELL, API, FILES]);
|
|
@@ -363,7 +363,20 @@ export class PluginRpcRouter {
|
|
|
363
363
|
/** blob:/data: carry their own bytes; anything else must be a declared endpoint. */
|
|
364
364
|
#artworkAllowed(record, src) {
|
|
365
365
|
if (!src) return false;
|
|
366
|
-
if (/^
|
|
366
|
+
if (/^data:image\//i.test(src)) return true;
|
|
367
|
+
// A `blob:` URL from a plugin frame is ALWAYS unusable here, and accepting one was
|
|
368
|
+
// worse than refusing it: the frame runs on an opaque origin, so its object URLs are
|
|
369
|
+
// `blob:null/…`, and this page cannot load another origin's blob. The browser says
|
|
370
|
+
// "Not allowed to load local resource" against the HOST document — a message that
|
|
371
|
+
// names neither the plugin nor the artwork, for a lock-screen image that simply never
|
|
372
|
+
// appeared.
|
|
373
|
+
//
|
|
374
|
+
// There is no version of this that works: a frame cannot mint a URL in this origin.
|
|
375
|
+
// Artwork has to arrive as bytes, which `data:image/…` above is.
|
|
376
|
+
if (/^blob:/i.test(src)) {
|
|
377
|
+
console.warn(`[trove] ${record.id}: media artwork must be a data: URL — a blob: from a sandboxed frame is opaque-origin and cannot be loaded here`);
|
|
378
|
+
return false;
|
|
379
|
+
}
|
|
367
380
|
return isAllowedUrl(networkEndpoints(record.manifest), src);
|
|
368
381
|
}
|
|
369
382
|
|