[Content Security Policy] Restrict `blob:` in `connect-src`

Open
#333 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
typescript
Domain
api

Research direction

Start in src/directLine.ts around line 807 and review how botframework-directlinejs retrieves attachment data and creates blob URLs. The work is complete when attachment uploads no longer require blob: in connect-src and object URLs can be reliably revoked; the issue does not name a test file or test entry point.

Written by the indexing model from the issue text.

Description

Feature Request

Today, we require this directive: connect-src blob:.

This is because botframework-directlinejs use blob URL to retrieve ArrayBuffer for uploading attachments. The code is at https://github.com/microsoft/BotFramework-DirectLineJS/blob/master/src/directLine.ts#L807.

To-do

To remove this directive, we need to modify botframework-directlinejs to use ArrayBuffer or Blob to upload attachments.

Also today, since we are using URL.createObjectURL, we don't have a reliable way to revoke the URL. Moving to ArrayBuffer or Blob will help.

[Enhancement]

Dominant language
TypeScript
Stars
199
Forks
133
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/BotFramework-DirectLineJS

All issues in microsoft/BotFramework-DirectLineJS

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.