Repository navigation
Decode data: URIs in fetchData instead of fetching them - #1773
Merged
Merged
Conversation
fetch() of a data: URL is checked against the CSP connect-src directive, so on pages that restrict it (sandboxed embeds, hardened sites) the browser refused the loading screen's inlined logo. fetchData now decodes data: URIs locally (base64 or percent-encoded) and returns the same Response-shaped object as the file: XHR path, so every parser gets it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JnzwA2LgdsfmEdYD4czqim
A non-base64 payload went through decodeURIComponent, which throws on a percent-encoded byte that is not part of valid UTF-8 (a lone %FF), so a binary data: URI that fetch() loads failed to load. It is now percent-decoded to bytes: each %XX is that byte, anything else its UTF-8 bytes. A media type left out but followed by parameters is text/plain, not ";charset=...". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SeWCkETjW35ZbXDRswV1hx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The default loading screen's logo is inlined by the build as a
data:image/png;base64,...URI, and every image went throughfetchData→fetch().fetch()of adata:URL is checked against the CSPconnect-srcdirective, so on pages that restrict it (sandboxed embeds, claude.ai artifacts, hardened sites) the browser refused it and the logo never showed.fetchDatanow decodesdata:URIs locally (base64 or percent-encoded, keeping the media type and its parameters) and returns the sameResponse-shaped object thefile:XHR path uses, so the code that handles the response is unchanged. Thedata:check runs before thefile:check, because on afile:page every URL would otherwise go to XHR. Since it sits infetchData, it covers adata:URI given to any asset type (image, json, binary, glTF, audio…), not only the logo. Other URLs are untouched.Verified with the built engine on a page served with
connect-src 'self':connect-srcviolation fordata:and an empty loading screenType of change
Checklist
drawmesh_bench,text-ink-clipping, plus intermittentlybitmaptext-glyph-effect,particle-tint-over-life) failed in my sandbox, and they fail the same way without this changetests/data-uri-load.spec.jsloads a data-URI PNG through the image parser and assertsfetchis never called; it also covers blob/arrayBuffer/text/json decoding and malformed URIsRelated issues
None
Generated by Claude Code