Describe the bug
The rendering of the preview panel in the files tab is done in an iframe. The request for the content has the header content-security-policy: default-src 'self' (added in app/controllers/application_controller.rb line 665), which blocks any external images from being loaded successfully.
To Reproduce
Steps to reproduce the behaviour:
It can be seen on the readme of https://workflowhub.org/workflows/2224 (in the files tab, not the overview page)
Expected behavior
All images (local and external) should display correctly.
Screenshots
The main logo image is a locally hosted image. The badges (eg "open in github codespaces") should all be images, but instead fall back to the alt text.
Desktop (please complete the following information):
- OS: Windows
- Browser Firefox Firefox 153.0.1 and Chrome 151.0.7922.72
Additional context
To fix this, img-src should be unset, but that can't be done directly as it falls through to default-src. As far as I can tell we would have to add each individual option without being able to set default-src. However, I don't know the security implications of doing this.
Describe the bug
The rendering of the preview panel in the files tab is done in an iframe. The request for the content has the header
content-security-policy: default-src 'self'(added inapp/controllers/application_controller.rb line 665), which blocks any external images from being loaded successfully.To Reproduce
Steps to reproduce the behaviour:
It can be seen on the readme of https://workflowhub.org/workflows/2224 (in the files tab, not the overview page)
Expected behavior
All images (local and external) should display correctly.
Screenshots
The main logo image is a locally hosted image. The badges (eg "open in github codespaces") should all be images, but instead fall back to the alt text.
Desktop (please complete the following information):
Additional context
To fix this,
img-srcshould be unset, but that can't be done directly as it falls through todefault-src. As far as I can tell we would have to add each individual option without being able to setdefault-src. However, I don't know the security implications of doing this.