[cgroschupp]

Opening an email failed because PDF.js tried to load the generated PDF through a Blob URL, which was blocked by the PDF viewer’s Content Security Policy:

Content-Security-Policy: The page's settings blocked the loading of a resource
(connect-src) at blob:https://cloud.example.com/...
because it violates the following directive: "connect-src 'self'"

PDF.js: Unexpected server response (0) while retrieving PDF.

I could only view an .eml file in Firefox 159 after adding the following to apps/files_pdfviewer/lib/Controller/DisplayController.php:

$policy->addAllowedConnectDomain('blob:');

This change removes the need for that workaround by passing the generated PDF directly to PDF.js as a Uint8Array through PDFViewerApplication.open({ data }) after initialization. No Blob URL or CSP change is required.

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI (N/A)

[odzhychko]

FYI It worked when I (and reviewers) tested, because Nextcloud Talk or Assistant was installed. It widens the CSP to allow blob:.

See https://github.com/search?q=org%3Anextcloud+%22addAllowedConnectDomain%28%27blob%3A%27%29%22&type=code

I'd like to avoid just widening the CSP (using AddContentSecurityPolicyEvent) like in https://github.com/nextcloud/spreed/blob/3171f9029be25bf55ef60ca41f38b7bee2ff1465/lib/Listener/CSPListener.php#L20

The proper fix would be to directly call PDF.js and no rely on a PDF viewer being installed. In hindsight something else then files_pdfviewer might be installed to preview PDFs which might also not be compatible with blob:.