fileuploader fixed

[veronika-tseleva-cleantalk]

No description provided.

[Copilot]

Pull request overview

This PR hardens FileUploader screenshot capture by filtering problematic DOM resources and updating distribution bundles.

Changes:

• Filters iframes, unsafe images, and inaccessible stylesheets.
• Updates resource-origin handling.
• Regenerates readable and minified bundles.

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated 1 comment.

File	Summary
js/src/fileuploader.js	Adds screenshot resource filtering. The image check should use node.currentSrc with a node.src fallback to handle cross-origin srcset selections.
dist/doboard-widget-bundle.min.js	Regenerated minified bundle.
dist/doboard-widget-bundle.js	Regenerated readable bundle.

Suppressed comments (2)

js/src/fileuploader.js:453

• Returning false removes the external <img> from the cloned DOM rather than replacing only its pixels. If the image participates in flex, grid, or inline layout, the successful dom-to-image path reflows surrounding content; the fallback path instead substitutes a transparent pixel and preserves the image box at lines 501-504. Replace the image in the clone or otherwise preserve its dimensions when excluding the resource.

                        if (node.tagName === 'IMG' && node.src && node.src.startsWith('http')) {
                            try {
                                const url = new URL(node.src);
                                if (url.origin !== currentOrigin && !node.crossOrigin) return false;

js/src/fileuploader.js:463

• toBlob is called with document.body, so the dom-to-image filter only visits body descendants. Normal <link rel="stylesheet"> elements live in document.head and never reach this branch, so inaccessible head stylesheets can still be processed and cause the capture to fail. Inspect document.styleSheets in a preflight or handle stylesheet links in a document-level clone instead.

                        if (node.tagName === 'LINK' && node.rel === 'stylesheet') {
                            try {
                                if (node.sheet && !node.sheet.cssRules) return false;
                            } catch (e) {
                                return false;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.