@bpmn-io/form-js-viewer 1.26.0 → 1.26.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.cjs +7 -1
  2. package/dist/index.cjs.map +1 -1
  3. package/dist/index.es.js +7 -1
  4. package/dist/index.es.js.map +1 -1
  5. package/package.json +1 -1
package/dist/index.cjs CHANGED
@@ -6336,7 +6336,13 @@ function PdfRenderer(props) {
6336
6336
  onError();
6337
6337
  return;
6338
6338
  }
6339
- const blob = await response.blob();
6339
+
6340
+ // Re-type the response instead of trusting its content type. An object URL
6341
+ // inherits the form's origin and <embed> renders it by the blob's own type,
6342
+ // so a response served as HTML would execute script in that origin.
6343
+ const blob = new Blob([await response.arrayBuffer()], {
6344
+ type: 'application/pdf'
6345
+ });
6340
6346
  objectUrl = URL.createObjectURL(blob);
6341
6347
  setPdfObjectUrl(objectUrl);
6342
6348
  } catch {