@bpmn-io/form-js-viewer 1.26.0 → 2.0.0-alpha.0

package/dist/index.es.js

@@ -675,7 +675,7 @@ function createInjector(bootstrapModules) {
  */
 function createFormContainer(prefix = 'fjs') {
   const container = document.createElement('div');
-  container.classList.add(`${prefix}-container`);
+  container.classList.add(`${prefix}-container`, 'bio-theme-parent');
   return container;
 }
 
@@ -6316,7 +6316,13 @@ function PdfRenderer(props) {
           onError();
           return;
         }
-        const blob = await response.blob();
+
+        // Re-type the response instead of trusting its content type. An object URL
+        // inherits the form's origin and <embed> renders it by the blob's own type,
+        // so a response served as HTML would execute script in that origin.
+        const blob = new Blob([await response.arrayBuffer()], {
+          type: 'application/pdf'
+        });
         objectUrl = URL.createObjectURL(blob);
         setPdfObjectUrl(objectUrl);
       } catch {
@@ -6624,7 +6630,7 @@ function Lightbox(props) {
         href: "https://bpmn.io",
         target: "_blank",
         rel: "noopener noreferrer",
-        style: "margin: 15px 20px 15px 10px; align-self: center; color: var(--cds-icon-primary, #404040)",
+        style: "margin: 15px 20px 15px 10px; align-self: center; color: #404040",
         children: jsx(Logo, {})
       }), jsxs("span", {
         children: ["Web-based tooling for BPMN, DMN, and forms powered by", ' ', jsx("a", {
@@ -6647,7 +6653,7 @@ function Link(props) {
       rel: "noopener noreferrer",
       class: "fjs-powered-by-link",
       title: "Powered by bpmn.io",
-      style: "color: var(--cds-text-primary, #404040)",
+      style: "color: #404040",
       onClick: props.onClick,
       children: jsx(Logo, {})
     })