openclaw - 💡(How to fix) Fix Control UI CSP blocks blob: avatar URLs generated by avatar fetch path [2 comments, 3 participants]

Summary

Control UI still serves a Content Security Policy that does not allow blob: images:

img-src 'self' data:

This can block avatar rendering in frontend paths that fetch /avatar/<agentId> and then render the result via URL.createObjectURL(await response.blob()).

This is related to #70700, but narrower and not the same issue. #70700 was closed as implemented because workspace-relative avatar paths are now normalized to /avatar/<agentId>. This issue is specifically about the CSP still rejecting blob: image URLs when the frontend uses blob object URLs for avatars.

Environment

• OpenClaw: 2026.4.23 (a979721)
• Control UI served by Gateway
• Local Gateway URL checked: http://127.0.0.1:18789/

Current behavior

On 2026.4.23, the live Control UI response still contains:

Content-Security-Policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' ws: wss:

So blob: is not allowed for images.

The built CSP helper also still emits:

"img-src 'self' data:"

Why this is separate from #70700

The workspace-relative path normalization part appears implemented. In 2026.4.23, the built bundle contains resolveAssistantAvatarUrl, which maps workspace-relative avatar values to /avatar/<agentId>.

That addresses the raw workspace-relative path issue.

However, the CSP issue remains if any Control UI avatar path does this:

const u = URL.createObjectURL(await response.blob())
img.src = u

Under the current CSP, the browser is allowed to fetch /avatar/<agentId>, but it is not allowed to render the resulting blob: URL as an image.

Expected behavior

If Control UI uses blob: URLs for fetched avatar images, its CSP should allow blob: in img-src, for example:

img-src 'self' data: blob:

Alternatively, Control UI should avoid converting avatar responses into blob: URLs and use the resolved /avatar/<agentId> route directly everywhere.

Actual behavior

The live page CSP in 2026.4.23 still omits blob::

img-src 'self' data:

This means browser rendering of avatar blob: URLs is blocked by CSP even when:

• the configured avatar path is valid
• /avatar/<agentId>?meta=1 resolves
• /avatar/<agentId> returns the correct image bytes
• workspace-relative path normalization has already happened

Minimal verification

curl -sSI http://127.0.0.1:18789/ | grep -i content-security-policy

Observed on 2026.4.23:

Content-Security-Policy: ... img-src 'self' data:; ...

Suggested fix

If blob: avatar rendering is still used anywhere in Control UI, update the CSP builder from:

"img-src 'self' data:"

to:

"img-src 'self' data: blob:"

or remove the blob: conversion from avatar rendering paths and consistently use resolved /avatar/<agentId> URLs.