[pratikbuilds]

Summary

Keeps script-capable sources out of links and frames in MediaViewer (findings 2 and 3).

• Download link: the link reused the media-element allowlist, which lets data:image/svg+xml through. That is safe in an <img>, but as a target="_blank" href it opens an SVG document that can run script. The link now uses a "link" sink (the internal "frame" sink, renamed) that accepts only http:, https: and blob:. A data: image still shows; it just gets no Download link.
• PDF preview removed: PDFs rendered in an unsandboxed <iframe>, so a URL labelled as a PDF that serves HTML ran script. Chrome refuses its PDF viewer in any sandboxed frame, and checking the bytes would mean fetching the URL, so a PDF now shows "No preview for this file." with its Download link. In Chrome, Download opens the native PDF viewer in a new tab.

Behaviour change: PDFs no longer preview inline. The README row and the component docs say so.

Verification

• bun run check
• bun run dep-guard
• Updated tests in media-src.test.ts and media-viewer.test.tsx

Closes #142

[corbits-triage]

Triage requests changes:

• Focused: mixes unrelated changes

[github-actions]

All contributors have signed the CLA.
_{Posted by the CLA Assistant Lite bot.}

[corbits-triage]

Triage requests changes:

• CI green: required checks are failing
• No ai attribution: a commit message contains "Co-Authored-By:"; remove it

[corbits-triage]

Triage requests changes:

• Focused: mixes unrelated changes

[TheGreatAxios]

Review · Request changes

Summary

The safeMediaSrc "link" sink and PDF <iframe> removal across src/lib/media-src.ts, src/ui/media-viewer.tsx, README.md, and unit tests are clean and pass bun run check and bun run dep-guard, but the commit history and PR description still include the backed-out use-media-viewer shrinking-list change (ddce89f + revert commit 0f4a976).

Blockers

• git log main..HEAD (ddce89f, 0f4a976) (reviewer) — ddce89f included finding 4 (src/hooks/use-media-viewer.ts and src/hooks/use-media-viewer.test.ts), and 0f4a976 (fix(media): leave the shrinking-list close for its own change) reverted those files rather than amending ddce89f. Both commits also have body lines exceeding 72 characters (0f4a976 is 80 chars; ddce89f has 73–74 char lines and still describes item 4 in its body). Per CONTRIBUTING.md:36-40, squash into a single commit whose message describes only findings 2 and 3 with body lines <= 72 characters.
• PR #148 body (reviewer) — The PR summary and verification section still claim finding 4 (shrinking lists and use-media-viewer.test.ts), which causes corbits-triage to fail (Focused: mixes unrelated changes). Update the PR body to reflect only the media-src and media-viewer changes.

Should-fix

None.

Informational

None.

Nothing triage asked to change still fails, so this request no longer stands.

[corbits-triage]

Triage requests changes:

• CI green: required checks are failing
  • policy-check

[TheGreatAxios]

Approving. The download link only accepts http, https, and blob, so a data SVG can still render and cannot be opened as a document. PDF preview is gone; there is no iframe.

The history is one commit and the body no longer mentions the shrinking-list change.

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Nothing triage asked to change still fails, so this request no longer stands.