Since version 2, rainbow requires a Content-Security-Policy that allows blob: in workers, to support this:
const blob = new Blob([fullString], { type: 'text/javascript' });
return new Worker((window.URL || window.webkitURL).createObjectURL(blob));
With a more restrictive CSP, this results in a CSP error logged to the console, and preloading blocks that keep spinning forever. In this case, it would be nice to have an option to make Rainbow run the syntax highlighting synchronously instead of in a worker.
Feel free to suggest other solutions to the problem “Rainbow doesn’t work due to CSP”, of course… for example – is it really necessary to construct the worker script as a blob? Can’t it get the entire rainbow.js file?
Since version 2, rainbow requires a Content-Security-Policy that allows
blob:in workers, to support this:With a more restrictive CSP, this results in a CSP error logged to the console, and preloading blocks that keep spinning forever. In this case, it would be nice to have an option to make Rainbow run the syntax highlighting synchronously instead of in a worker.
Feel free to suggest other solutions to the problem “Rainbow doesn’t work due to CSP”, of course… for example – is it really necessary to construct the worker script as a blob? Can’t it get the entire
rainbow.jsfile?