From 217fc060ee0a976acc9e046a3dd8ed5f3d7470da Mon Sep 17 00:00:00 2001
From: Florian Hotze <florianh_dev@icloud.com>
Date: Sun, 22 Sep 2024 00:45:03 +0200
Subject: [PATCH] CSP: Allow loading of workers from blob: URIs (#2765)

Fixes issues with VideoJS reported on the community:

https://community.openhab.org/t/openhab-4-3-milestone-discussion/158139/26.

Signed-off-by: Florian Hotze <florianh_dev@icloud.com>
---
 bundles/org.openhab.ui/web/src/index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bundles/org.openhab.ui/web/src/index.html b/bundles/org.openhab.ui/web/src/index.html
index 2b4693f685..266edf2ea9 100644
--- a/bundles/org.openhab.ui/web/src/index.html
+++ b/bundles/org.openhab.ui/web/src/index.html
@@ -21,9 +21,10 @@
     * allow loading media from any source, and data:, blob: and media: URIs
     * allow embedding (<iframe>) any source
     * allow connecting (through fetch(), XMLHttpRequest, WebSocket etc.) to the same origin, raw.githubusercontent.com (add-on logos etc.), Iconify icon sources, and any source
+    * allows loading web workers from the same origin, and blob: URIs
   -->
   <% if (process.env.NODE_ENV === 'production') { %>
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src * data:; media-src * data: blob: media:; frame-src *; connect-src 'self' raw.githubusercontent.com api.iconify.design api.unisvg.com api.simplesvg.com *;">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src * data:; media-src * data: blob: media:; frame-src *; connect-src 'self' raw.githubusercontent.com api.iconify.design api.unisvg.com api.simplesvg.com *; worker-src 'self' blob:;">
   <% } %>
   <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, minimal-ui, viewport-fit=cover">