Skip remote URLs in thumbnail generation

src/utils/__tests__/imageThumbnail.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { generateThumbnail } from "../imageThumbnail";
+
+describe("generateThumbnail", () => {
+  it("returns empty sources unchanged", async () => {
+    await expect(generateThumbnail("")).resolves.toBe("");
+  });
+
+  it("does not export remote image URLs through canvas", async () => {
+    const remoteUrl = "https://r2cdn.copilotbase.com/r2cdn2/generated.png";
+
+    await expect(generateThumbnail(remoteUrl)).resolves.toBe(remoteUrl);
+  });
+});

src/utils/imageThumbnail.ts

@@ -9,10 +9,12 @@ export async function generateThumbnail(
   quality: number = 0.6
 ): Promise<string> {
   if (!base64DataUrl) return base64DataUrl;
+  if (!base64DataUrl.startsWith("data:image/")) return base64DataUrl;
 
   return new Promise((resolve) => {
     const img = new Image();
     img.onload = () => {
+      try {
         const { naturalWidth: w, naturalHeight: h } = img;
 
         // Skip if already small enough
@@ -38,6 +40,9 @@ export async function generateThumbnail(
 
         ctx.drawImage(img, 0, 0, newW, newH);
         resolve(canvas.toDataURL("image/jpeg", quality));
+      } catch {
+        resolve(base64DataUrl);
+      }
     };
     img.onerror = () => resolve(base64DataUrl);
     img.src = base64DataUrl;