Sanitize URL from URL.createObjectURL()

[compulim]

Changelog Entry

Added

• Added blob URL sanitization and ESLint rules, in PR #5568, by @compulim

Description

Add content type sanitization when creating blob URL.

Specific Changes

• Modified .eslintrc.yml to restrict usage on URL.createObjectURL
• Sanitized content type of all blob URLs
• Ported <ImageAttachment> and readDataURIToBlob to TypeScript
• Added tests

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Pull Request Overview

This PR implements blob URL sanitization to enhance security by enforcing content type sanitization when creating blob URLs. The key security concern is that blob URLs can bypass Content Security Policy restrictions, so proper content type sanitization prevents potential abuse.

• Added ESLint rules to restrict direct usage of URL.createObjectURL() without proper sanitization
• Implemented content type sanitization across all blob URL creation points in the codebase
• Converted ImageAttachment component and readDataURIToBlob utility from JavaScript to TypeScript

Reviewed Changes

Copilot reviewed 14 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.eslintrc.production.yml	Added ESLint rule to restrict URL.createObjectURL usage
packages/component/src/Utils/readDataURIToBlob.ts	Converted to TypeScript with improved type safety
packages/component/src/Attachment/ImageAttachment.tsx	Converted to TypeScript with content type sanitization for image blobs
packages/component/src/Attachment/ImageAttachment.js	Removed JavaScript version
packages/core/src/sagas/sendMessageToPostActivitySaga.ts	Added content type sanitization for file attachments
packages/component/src/hooks/useSendFiles.ts	Added content type sanitization for file uploads
Multiple style files	Added ESLint disable comments for hardcoded content cases
Test files	Added comprehensive tests for content type sanitization behavior
CHANGELOG.md	Updated with PR information

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}