microsoft / microsoft/BotFramework-DirectLineJS
[Content Security Policy] Restrict `blob:` in `connect-src`
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 199
- Forks
- 133
- PR merge metrics
- No merged PRs in 30d
Description
Feature Request
Today, we require this directive: connect-src blob:.
This is because botframework-directlinejs use blob URL to retrieve ArrayBuffer for uploading attachments. The code is at https://github.com/microsoft/BotFramework-DirectLineJS/blob/master/src/directLine.ts#L807.
To-do
To remove this directive, we need to modify botframework-directlinejs to use ArrayBuffer or Blob to upload attachments.
Also today, since we are using URL.createObjectURL, we don't have a reliable way to revoke the URL. Moving to ArrayBuffer or Blob will help.
[Enhancement]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/directLine.ts around line 807 and review how botframework-directlinejs retrieves attachment data and creates blob URLs. The work is complete when attachment uploads no longer require blob: in connect-src and object URLs can be reliably revoked; the issue does not name a test file or test entry point.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100