Breaks in Firefox browser add-ons (aka browser extensions)

[jankoegel]

The Problem

• we try using qr-scanner in a Firefox browser add-on/extension.
• works in Chrome. Starts but doesn't detect any QR code in Firefox. No error message logged (except a reader timeout)
• demos of qr-scanner (outside of browser extensions, on normal websites) work in Firefox. Example: https://codepen.io/jankoegel/pen/yLEmGxJ
• same errors with the legacy.min.js script.
• our code: chore: replace html5-qrcode with qr-scanner getAlby/lightning-browser-extension#1862
• debugging notes: QR code: debugging with hacky legacy.min getAlby/lightning-browser-extension#1899 (comment)

Ideas

• we think the problem is around the web worker.
• you cannot normally start a web worker in a browser extension (you cannot even load inline <script>s there, part of the content security policy)
• the fix suggested here helps to fix a script loading error that only appears in Firefox:
  https://stackoverflow.com/a/64621646
  but we still cannot read QR codes :(
• things seem to go wrong when setting an event listener on the worker here:
  

  qr-scanner/src/qr-scanner.ts

  Line 538 in abcfe1b

  qrEngineWorker.addEventListener('message', onMessage);

  
  Probably this is not permitted in a Firefox browser add-on!?

Help needed

• does anyone have experience with a similar setup?
• what else could we do to fix things?

[jankoegel]

We fixed it by allowing blob URLs (which is how the worker is loaded by qr-scanner) in the browser add-on's manifest.json's Content Security Policy setting:

- "content_security_policy": "script-src 'self'; object-src 'self'",
+ "content_security_policy": "script-src 'self' blob:; object-src 'self'",

Apparently Chrome doesn't require this.
Found the idea here: https://bugzilla.mozilla.org/show_bug.cgi?id=1294996#c4

Closing this issue now, might help other people running into this issue with Firefox addons later :)

[jankoegel]

we decided against using QR scanner in our project because we don't want to add unrestricted blob: to our extension's content_security_policy setting.
Related Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1294996