Sakurai/pdf.js
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "Don't block origin-less blob:-URLs in hosted viewer"

Browse Source 
This reverts commit a6aca3cabe581319d93c862cb0b85f71580cacfd, since no version of Internet Explorer is supported any more.
This commit is contained in:
Jonas Jenwald 2022-02-12 11:32:10 +01:00
parent e9fd67a3f6
commit 911021002e
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
web/app.js
View File

@ -2127,14 +2127,11 @@ if (typeof PDFJSDev === "undefined" || PDFJSDev.test("GENERIC")) {
// Hosted or local viewer, allow for any file locations
return;
}
const { origin, protocol } = new URL(file, window.location.href);
const fileOrigin = new URL(file, window.location.href).origin;
// Removing of the following line will not guarantee that the viewer will
// start accepting URLs from foreign origin -- CORS headers on the remote
// server must be properly configured.
// IE10 / IE11 does not include an origin in `blob:`-URLs. So don't block
// any blob:-URL. The browser's same-origin policy will block requests to
// blob:-URLs from other origins, so this is safe.
if (origin !== viewerOrigin && protocol !== "blob:") {
if (fileOrigin !== viewerOrigin) {
throw new Error("file origin does not match viewer's");
}
} catch (ex) {