Set worker-src CSP to also allow blob:

Kagemaru · Kagemaru · commit 83db2d9c1475 · 2025-07-04T13:15:27.000+02:00
diff --git a/config/initializers/decidim.rb b/config/initializers/decidim.rb
@@ -141,7 +141,8 @@
 
   config.content_security_policies_extra = {
     "connect-src" => "photon.komoot.io",
-    "worker-src" => %w('self')
+    "worker-src" => %w('self', 'blob:'),
+    "child-src" => %w('self', 'blob:')
   }
 
   if Rails.application.secrets.maps.present? && Rails.application.secrets.maps[:static_provider].present?

Original file line number	Diff line number	Diff line change
`@@ -141,7 +141,8 @@`
`141`	`141`
`142`	`142`	`config.content_security_policies_extra = {`
`143`	`143`	`"connect-src" => "photon.komoot.io",`
`144`		`- "worker-src" => %w('self')`
	`144`	`+ "worker-src" => %w('self', 'blob:'),`
	`145`	`+ "child-src" => %w('self', 'blob:')`
`145`	`146`	`}`
`146`	`147`
`147`	`148`	`if Rails.application.secrets.maps.present? && Rails.application.secrets.maps[:static_provider].present?`