oddbird
[BUG] Stylesheet `<link>` URLs are swapped for `blob`s in v0.2.0
Describe the bug
I have an existing Rails application that I just upgraded from v0.1.0 to v0.2.0 and I’m now getting security warnings in the console:
Security Error: Content at http://localhost:3000/ may not load data from blob:http://localhost:3000/c359010b-028d-4dc6-823e-0ec6a8f4c19a.
I’m noticing that the stylesheets linked in the <head> have blob: URLs - I’m not sure if this is new:
<link rel="stylesheet" href="blob:http://localhost:3000/c359010b-028d-4dc6-823e-0ec6a8f4c19a">
This issue is also causing my fonts not to load.
If I remove import "@oddbird/css-anchor-positioning" the issue goes away.
To Reproduce Use the polyfill. I’ve not determined if this is isolated to Rails or Turbo.
Expected behavior No console security error.
Browsers tested on macOS, Firefox 131
I was fiddling around with a bunch different settings, package versions, etc and after getting everything reset to where it was, now I notice that only one of my stylesheet URLs is getting the blob: treatment.
<link rel="stylesheet" href="/assets/application-3282d104.css" data-turbo-track="reload" media="screen">
<link rel="stylesheet" href="blob:http://localhost:3000/047112b1-2693-44b1-892a-2ee3851fed29">
Minutes ago when I opened this issue, both of those were getting replaced. So far I’ve been unsuccessful in re-creating.
When styles are polyfilled, the URL is replaced with a blob: URL -- this is intentional, and not a change from v0.1.*. I'm not sure why you were seeing some links polyfilled and others not (unless their contents no longer included CSS that required polyfilling?), but this specific error should be fixed in v0.3.0.
