@bpmn-io/form-js-playground 1.26.0 → 1.26.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -35535,7 +35535,13 @@ Please report this to https://github.com/markedjs/marked.`, e) {
35535
35535
  onError();
35536
35536
  return;
35537
35537
  }
35538
- const blob = await response.blob();
35538
+
35539
+ // Re-type the response instead of trusting its content type. An object URL
35540
+ // inherits the form's origin and <embed> renders it by the blob's own type,
35541
+ // so a response served as HTML would execute script in that origin.
35542
+ const blob = new Blob([await response.arrayBuffer()], {
35543
+ type: 'application/pdf'
35544
+ });
35539
35545
  objectUrl = URL.createObjectURL(blob);
35540
35546
  setPdfObjectUrl(objectUrl);
35541
35547
  } catch {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bpmn-io/form-js-playground",
3
- "version": "1.26.0",
3
+ "version": "1.26.1",
4
4
  "description": "A form-js playground",
5
5
  "files": [
6
6
  "dist"
@@ -46,8 +46,8 @@
46
46
  },
47
47
  "dependencies": {
48
48
  "@bpmn-io/cm-theme": "^0.2.2",
49
- "@bpmn-io/form-js-editor": "^1.26.0",
50
- "@bpmn-io/form-js-viewer": "^1.26.0",
49
+ "@bpmn-io/form-js-editor": "^1.26.1",
50
+ "@bpmn-io/form-js-viewer": "^1.26.1",
51
51
  "@codemirror/autocomplete": "^6.20.0",
52
52
  "@codemirror/commands": "^6.10.1",
53
53
  "@codemirror/lang-json": "^6.0.2",