Arena sandbox CSP: allow blob: in img-src/media-src (same-origin inline-generated, safe for artifacts)

7962eedd38ed07a3e761445beb36c9eb15b60d04 · 2026-07-25 10:20:47 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 7962eedd38ed07a3e761445beb36c9eb15b60d04
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Jul 25 10:20:47 2026 -0700

    Arena sandbox CSP: allow blob: in img-src/media-src (same-origin inline-generated, safe for artifacts)
---
 server.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 7500a4a..c353232 100644
--- a/server.js
+++ b/server.js
@@ -872,7 +872,7 @@ iframe{width:100%;height:460px;border:0;background:#000}.c.win iframe{height:560
     res.writeHead(200, {
       'Content-Type': 'text/html; charset=utf-8',
       // artifacts are untrusted model output — no network, no top-level nav
-      'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; media-src data:; font-src data:",
+      'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; media-src data: blob:; font-src data:",
       'X-Frame-Options': 'SAMEORIGIN',
     });
     return res.end(fs.readFileSync(fp));
@@ -930,7 +930,7 @@ iframe{width:100%;height:460px;border:0;background:#000}.c.win iframe{height:560
     if (!fs.existsSync(fp)) { res.writeHead(404); return res.end('no game'); }
     res.writeHead(200, {
       'Content-Type': 'text/html; charset=utf-8',
-      'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; media-src data:; font-src data:",
+      'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; media-src data: blob:; font-src data:",
       'X-Frame-Options': 'SAMEORIGIN',
     });
     return res.end(fs.readFileSync(fp));

← 35ba974 Agent-driven high-detail: DW Mood Board Studio (frontend-dev · back to Model Arena · Agent-driven high-detail: DW Room Visualizer (frontend-devel d8a6d45 →