Block blob in Firefox ESR (52)

lib/dataUrls.js

@@ -16,8 +16,11 @@
 	const logging = require("./logging");
 	const settings = require("./settings");
 	let canMergeHeader = false;
+	let blockBlob = true;
 	browser.runtime.getBrowserInfo().then(function(info){
-		canMergeHeader = parseInt(info.version.replace(/\..+/, ""), 10) > 59;
+		const mainVersion = parseInt(info.version.replace(/\..+/, ""), 10);
+		canMergeHeader = mainVersion > 59;
+		blockBlob = mainVersion < 60;
 	});
 	function setHeader(headers, header){
 		if (canMergeHeader){
@@ -38,9 +41,9 @@
 	}
 	
 	scope.init = function(){
-		const cspMatch = "blob: filesystem: *";
 		browser.webRequest.onHeadersReceived.addListener(
 			function(details){
+				const cspMatch = (blockBlob? "": "blob: ") + "filesystem: *";
 				const headers = details.responseHeaders;
 				if (settings.blockDataURLs){
 					logging.verbose("Adding CSP header to", details);

releaseNotes.txt

@@ -7,6 +7,7 @@ Version 0.5.2:
 	
 	fixes:
 		- optimized CSP
+		- in Firefox ESR (52) iFrames with a blob-URL cannot be protected -> they have to blockes there as well
 	
 	known issues:
 		- if a data URL is blocked the page action button does not appear