hm, that doesn't match *.wikipedia.org ?

hm, that doesn't match *.wikipedia.org ?

No, blob: urls aren't included in generic domains. They have to be whitelisted separately.

AFAIK, allowing blob: urls is equivalent to allowing unsafe-eval (Since the blob uri scheme is a lot like the data: uri scheme). Which is something that ideally we would get rid of in the long term (Ideally there would be no way to dynamically create JS, thus eliminating the risk of JS insertion). Although I suppose that the long term is very far away.

Change 546421 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/extensions/CodeEditor@master] Make CodeEditor compatible with CSP

https://gerrit.wikimedia.org/r/546421

Change 546421 merged by jenkins-bot:
[mediawiki/extensions/CodeEditor@master] Make CodeEditor compatible with CSP

https://gerrit.wikimedia.org/r/546421

FYI, the blob is used to load a JS worker. JS workers cannot be loaded cross domain (no support for CORS). We used to have the JS hosted on the static domain and it required this method to do the loading... (it was actually added to Ace specifically for us, by me). It seems that since Ace updated this worker loading to ALWAYS use a blob.. Not sure why, though commit logs seem to imply to avoid issues on IE..

It seems there is also an upstream option to bypass loading via blob now, using the loadWorkerFromBlob config option.
https://github.com/ajaxorg/ace/commit/30522154a1d7fe37744def3fae4bc3d0a74319bc

We might wanna investigate that.

Interesting. I guess I naively would have assumed workers follow the usually JS loading, where it can execute cross domain but can't read.

It doesn't really matter that much in terms of CSP security - allowing blob, is mostly a form of eval(), and we're already allowing eval for RLStorage.