@bpmn-io/form-js-viewer 1.26.0 → 1.26.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +7 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.es.js +7 -1
- package/dist/index.es.js.map +1 -1
- package/package.json +1 -1
package/dist/index.es.js
CHANGED
|
@@ -6316,7 +6316,13 @@ function PdfRenderer(props) {
|
|
|
6316
6316
|
onError();
|
|
6317
6317
|
return;
|
|
6318
6318
|
}
|
|
6319
|
-
|
|
6319
|
+
|
|
6320
|
+
// Re-type the response instead of trusting its content type. An object URL
|
|
6321
|
+
// inherits the form's origin and <embed> renders it by the blob's own type,
|
|
6322
|
+
// so a response served as HTML would execute script in that origin.
|
|
6323
|
+
const blob = new Blob([await response.arrayBuffer()], {
|
|
6324
|
+
type: 'application/pdf'
|
|
6325
|
+
});
|
|
6320
6326
|
objectUrl = URL.createObjectURL(blob);
|
|
6321
6327
|
setPdfObjectUrl(objectUrl);
|
|
6322
6328
|
} catch {
|