CSP error when loading blob URL scripts in sidepanel for AudioWorklets

[Spike O'Carroll]

I'm trying to use `audioContext.audioWorklet.addModule(blobURL)`, which takes a URL to a JS module for the worklet script code. The standard way to do this is with URL.createObjectURL(), which gives a `blob:chrome-extension://` URL.

However, this returns a CSP error:

Refused to load the script 'blob:chrome-extension://lggdjpggkblgclidokfpabbldmahbdcm/706cde56-dfd6-4a25-951b-f3ac8c8edc99' because it violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' http://localhost:3000". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

It appears blob scripts are blocked by the extension's content_security_policy in the manifest.json and trying `extension_pages: "script-src 'self' blob:; object-src 'self' blob:"`, causes error Invalid value: blob: on browser start.

Any ideas on how to fix? Thank you!

[wOxxOm]

Do it inside an iframe that is declared as sandbox.

[Jackie Han]

Just want to know why you can't use a file url directly? for example, `audioWorklet.addModule('processors.js')`

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/ce8518ed-6258-4d31-9d8d-67db09b7de1cn%40chromium.org.