Block data URLs instead of their requests

Fixes #211

lib/dataUrls.js

@@ -16,34 +16,25 @@
 	const logging = require("./logging");
 	const settings = require("./settings");
 	
-
-	const dataUrlFrames = new Set();
 	scope.init = function(){
-		browser.webRequest.onBeforeRequest.addListener(
+		browser.webRequest.onHeadersReceived.addListener(
 			function(details){
-				if (
-					details.url.startsWith("data:text")
-				){
-					dataUrlFrames.add(details.frameId);
-					logging.message("Detected data URL", details);
-				}
-				else if (
-					settings.blockRequestsFromDataURL &&
-					dataUrlFrames.has(details.frameId)
-				){
-					logging.warning("Blocking request from data-URL frame.", details);
-					if (
-						settings.get("showNotifications")
-					){
-						browser.pageAction.show(details.tabId);
-					}
-					return {cancel: true};
+				const headers = details.responseHeaders;
+				if (settings.blockDataURLs){
+					logging.verbose("Adding CSP header to", details);
+					headers.push({
+						name: "Content-Security-Policy",
+						value: "object-src *; child-src *"
+					});
 				}
+				return {
+					responseHeaders: headers
+				};
 			},
 			{
 				urls: ["<all_urls>"]
 			},
-			["blocking"]
+			["blocking", "responseHeaders"]
 		);
 	};