fix(canvas): 修复线上视频节点截首尾帧画布污染报错#102
Merged
Merged
Conversation
线上 STATIC_VIA_OSS 开启后,/projects/.../media/* 会 302 到跨域的 OSS 预签名 URL。截帧离屏 <video> 的 mediaNeedsCrossOrigin 只对绝对 http(s) URL 设 crossOrigin,相对路径跟随 302 后以 no-cors 模式加载 跨域视频,drawImage 污染画布,toBlob 抛 SecurityError(本地走同源 FileResponse 所以无此问题)。 改为除 data:/blob:(永不污染画布)外一律 crossOrigin="anonymous": 同源响应不需要 ACAO,CORS 模式无副作用;302 到 OSS 后浏览器带 Origin 走 CORS。已实测线上 bucket novelvideo-assets-chengdu 对站点 origin(https://dramaclaw.cdnfg.com)的 preflight 与 GET 均返回 Access-Control-Allow-Origin 且带 Vary: Origin。 注意:dramaclaw.ai 不在 bucket CORS 白名单(目前 301 到 cdnfg.com 无影响);若未来该域名直接跑应用,需在 OSS CORS 规则补充。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: wen xin <1464521427@qq.com>
Handanhhhy
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
线上画布视频节点「截首帧/尾帧」卡住,Console 报:
本地环境正常。
根因
STATIC_VIA_OSS,后端_serve_or_redirect_to_oss对/projects/.../media/*会 302 到跨域的 OSS 预签名 URL;本地走同源FileResponse,所以本地无此问题。<video>的mediaNeedsCrossOrigin只对绝对http(s)://URL 设crossOrigin="anonymous",相对路径不设。drawImage污染画布 →toBlob抛SecurityError。修复
mediaNeedsCrossOrigin改为:除data:/blob:(永不污染画布)外一律返回 true。同源响应不需要 ACAO,CORS 模式无副作用;302 到 OSS 后浏览器带Origin走 CORS 拿到 ACAO,画布不再污染。一处 helper 覆盖全部 5 个画布导出路径(VideoNode 截帧、VideoClipPanel、filmstrip、CoverEditor、loadImageElement)。验证
novelvideo-assets-chengdu:对站点 originhttps://dramaclaw.cdnfg.com的 preflight(OPTIONS)与实际 GET 均返回Access-Control-Allow-Origin,且带Vary: Origin(浏览器缓存不会串用 no-cors 响应)tsc -b、pnpm build、canvas 相关 vitest 全部通过注意
dramaclaw.ai不在 bucket CORS 白名单(实测 403)。目前它 301 到 cdnfg.com 无影响;若未来该域名直接跑应用,需在 OSS bucket CORS 规则里补充该 origin。🤖 Generated with Claude Code