Harden image security

.changeset/brave-singers-refuse.md

@@ -0,0 +1,5 @@
+---
+"streamdown": patch
+---
+
+harden image security

apps/website/app/components/styles.tsx

@@ -31,6 +31,9 @@ export const Styles = () => (
   <Section
     description="Streamdown comes with built-in Tailwind classes for common Markdown components — headings, lists, code blocks, and more."
     markdown={markdown}
+    streamdownProps={{
+      allowedImagePrefixes: ['https://placehold.co'],
+    }}
     title="Built-in typography styles"
   />
 );

packages/streamdown/index.tsx

@@ -86,20 +86,27 @@ export const Streamdown = memo(
       () => () => rehypeKatex({ errorColor: 'var(--color-muted-foreground)' }),
       []
     );
+    const origin = useMemo(() => {
+      if (typeof window === 'undefined') {
+        return;
+      }
+
+      return window.location.origin;
+    }, []);
 
     return (
       <ShikiThemeContext.Provider value={shikiTheme}>
         <div className={cn('space-y-4', className)} {...props}>
           {blocks.map((block, index) => (
             <Block
-              allowedImagePrefixes={allowedImagePrefixes ?? ['*']}
+              allowedImagePrefixes={allowedImagePrefixes ?? ['self']}
               allowedLinkPrefixes={allowedLinkPrefixes ?? ['*']}
               components={{
                 ...defaultComponents,
                 ...components,
               }}
               content={block}
-              defaultOrigin={defaultOrigin}
+              defaultOrigin={defaultOrigin ?? origin}
               // biome-ignore lint/suspicious/noArrayIndexKey: "required"
               key={`${generatedId}-block_${index}`}
               rehypePlugins={[rehypeKatexPlugin, ...(rehypePlugins ?? [])]}