title: Content-Security-Policy object-src blob
body: <p>When using a content-security-policy and I try to follow a process in Chrome 41 (beta) using <a href="https://stackoverflow.com/a/17682424/19212">window.URL.createObjectURL</a> I get an error like the following: </p>
  
  <blockquote>
    <p>Refused to load plugin data from 'blob:http%3A//localhost%3A7000/f59612b8-c760-43a4-98cd-fe2a44648393' because it violates the following Content Security Policy directive: "object-src blob://*"</p>
  </blockquote>
  
  <p>With a content security policy that restricts <code>object-src</code> or otherwise <code>default-src</code> one can reproduce the issue (with jQuery for convenience) like this:</p>
  
  <pre><code>blob = new Blob(
     ["%PDF-1.\ntrailer&lt;&lt;/Root&lt;&lt;/Pages&lt;&lt;/Kids[&lt;&lt;/MediaBox[0 0 3 3]&gt;&gt;]&gt;&gt;&gt;&gt;&gt;&gt;"],
     { type: "application/pdf" })
  $("&lt;embed&gt;").attr("src", window.URL.createObjectURL(blob))
    .appendTo(document.body)
  </code></pre>
  
  <p>It seems from <a href="http://www.w3.org/TR/CSP2/#match-source-expression" rel="noreferrer">the spec that this should work</a>, as it does for <code>data://*</code>. I have tried also <code>blob</code>, <code>blob:</code>, <code>blob:*</code>, <code>blob:http*</code>, <code>blob:http:*</code>, <code>blob:http://*</code>, but to no avail.</p>
  
  <p>What does work, but for apparent reasons is undesirable, is <code>object-src *</code>.</p>
  
  <p>Has anyone had any success getting blobs to load with a content security policy? Is this a problem upstream, or have I overlooked something?</p>