Image compression loads its worker script from cdn.jsdelivr.net #11

New issue

Closed

opened 2026-10-12 10:32:05 +09:00 by bot-genji1024 · 0 comments

bot-genji1024 commented

2026-10-12 10:32:05 +09:00

Collaborator

Problem

prepareImage (client/src/media.ts) calls browser-image-compression with useWebWorker: true. The library then starts a blob: worker that runs importScripts(libURL), and libURL defaults to https://cdn.jsdelivr.net/npm/[email protected]/dist/browser-image-compression.js. So every install, including the family instance, runs third-party code from a CDN whenever someone picks a picture, and tells the CDN when that happens. If the CDN is unreachable or blocked, the library falls back to compressing on the main thread, which freezes the page for large photos.

It also fails under the preview CSP from #9 (script-src 'self'), which only allows same-origin scripts.

Plan

Bundle the library's own UMD build (dist/browser-image-compression.js, which defines the global imageCompression that the worker expects) as a static asset with Vite's ?url import, and pass it as libURL.
The worker runs from a blob: URL, where relative URLs do not resolve, so pass the absolute URL (new URL(url, location.href)).
Verify: the build emits the script under /assets/, the bundle no longer needs jsdelivr, and on the pull request's preview, posting a picture works with the worker (no CSP violation, no fallback).

## Problem `prepareImage` (`client/src/media.ts`) calls `browser-image-compression` with `useWebWorker: true`. The library then starts a `blob:` worker that runs `importScripts(libURL)`, and `libURL` defaults to `https://cdn.jsdelivr.net/npm/[email protected]/dist/browser-image-compression.js`. So every install, including the family instance, runs third-party code from a CDN whenever someone picks a picture, and tells the CDN when that happens. If the CDN is unreachable or blocked, the library falls back to compressing on the main thread, which freezes the page for large photos. It also fails under the preview CSP from #9 (`script-src 'self'`), which only allows same-origin scripts. ## Plan - Bundle the library's own UMD build (`dist/browser-image-compression.js`, which defines the global `imageCompression` that the worker expects) as a static asset with Vite's `?url` import, and pass it as `libURL`. - The worker runs from a `blob:` URL, where relative URLs do not resolve, so pass the absolute URL (`new URL(url, location.href)`). - Verify: the build emits the script under `/assets/`, the bundle no longer needs jsdelivr, and on the pull request's preview, posting a picture works with the worker (no CSP violation, no fallback).

bot-genji1024 referenced this issue from a commit

2026-10-12 10:34:05 +09:00

fix(media): serve the image-compression worker's script ourselves

bot-genji1024 referenced this issue from a pull request that will close it,

2026-10-12 10:34:11 +09:00

fix(media): serve the image-compression worker's script ourselves #12