Merge pull request #1073 from vector-im/bwindels/export-blobhandle-sdk

export BlobHandle and add method to create handle from buffer

src/lib.ts

@@ -21,6 +21,7 @@ export {ConsoleReporter} from "./logging/ConsoleReporter";
 export {Platform} from "./platform/web/Platform.js";
 export {FeatureSet, FeatureFlag} from "./features.js";
 export {Client, LoadStatus, LoginFailure} from "./matrix/Client.js";
+export {BlobHandle} from "./platform/web/dom/BlobHandle";
 export {RoomStatus} from "./matrix/room/common";
 export {AttachmentUpload} from "./matrix/room/AttachmentUpload";
 export {CallIntent} from "./matrix/calls/callEventTypes";

src/platform/web/dom/BlobHandle.js

@@ -74,12 +74,23 @@ const ALLOWED_BLOB_MIMETYPES = {
 const DEFAULT_MIMETYPE = 'application/octet-stream';
 
 export class BlobHandle {
+    /** 
+     * @internal
+     * Don't use the constructor directly, instead use fromBuffer, fromBlob or fromBufferUnsafe
+     * */
     constructor(blob, buffer = null) {
         this._blob = blob;
         this._buffer = buffer;
         this._url = null;
     }
 
+    /** Does not filter out mimetypes that could execute embedded javascript.
+     * It's up to the callee of this method to ensure that the blob won't be
+     * rendered by the browser in a way that could allow cross-signing scripting. */
+    static fromBufferUnsafe(buffer, mimetype) {
+        return new BlobHandle(new Blob([buffer], {type: mimetype}), buffer);
+    }
+
     static fromBuffer(buffer, mimetype) {
         mimetype = mimetype ? mimetype.split(";")[0].trim() : '';
         if (!ALLOWED_BLOB_MIMETYPES[mimetype]) {