CSP: allow blob as worker-src (#173142)

fixes #173104
microsoft · Feb 2, 2023 · 86b34fd · 86b34fd
1 parent bf3e759
commit 86b34fd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/vs/server/node/webClientServer.ts b/src/vs/server/node/webClientServer.ts
@@ -346,7 +346,7 @@ export class WebClientServer {
 			`script-src 'self' 'unsafe-eval' ${this._getScriptCspHashes(data).join(' ')} 'sha256-fh3TwPMflhsEIpR8g1OYTIMVWhXTLcjQ9kh2tIpmv54=' http://${remoteAuthority};`, // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
 			'child-src \'self\';',
 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
-			'worker-src \'self\' data:;',
+			'worker-src \'self\' data: blob:;',
 			'style-src \'self\' \'unsafe-inline\';',
 			'connect-src \'self\' ws: wss: https:;',
 			'font-src \'self\' blob:;',