Question

I’ve got some troubles with my new ChromeApp.

So.. I’ve started using JavaScript FileSystem API, so i
use it to create mp3 files (my app is a html5 player).

The FileEntry object from the FileSystem API gives the toURL() method
for files which are stored in filesystem. In the ChormeApps this method
returns something like this:

filesystem:chrome-extension://mhldgbaidgpagmimniipggmajbodaeco/persistent/cbd416046ae7a567d4629fc38ac80864.mp3

But when i trying to use this url in <audio> tag as value for src attribute
i getting this error:

Refused to load media from 'filesystem:chrome-extension://mhldgbaidgpagmimniipggmajbodaeco/persistent/cbd416046ae7a567d4629fc38ac80864.mp3' because of Content-Security-Policy.

So i tried to use clear name with relative path

<audio src="cbd416046ae7a567d4629fc38ac80864.mp3" />

and with Chrome App root path

<audio src="chrome-extension://mhldgbaidgpagmimniipggmajbodaeco/cbd416046ae7a567d4629fc38ac80864.mp3"/>

and with “persistent” folder

<audio src="chrome-extension://mhldgbaidgpagmimniipggmajbodaeco/persistent/cbd416046ae7a567d4629fc38ac80864.mp3"/>

In last 3 cases i’ve got 404 error.
So, how can i enable loading media from filesystem? Something in the manifest in the content_security_policy or maybe in the permissions? Or there is some magical path to use?

Thanks in advance for your answers.

Update:
I using content_security_policy directive:

default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' http://*.userapi.com; script-src 'self' 'unsafe-eval'; connect-src 'self' http://*.userapi.com http://vk.com http://last.fm http://ws.audioscrobbler.com; media-src 'self';

But media-src 'self' doesn’t brought needed results. I still gettin’ error “Refused load media”.

Update 2:
I’ve found an ugly hack to do what i want: media-src: 'self' * does the job. But if you have some ideas on how to solve this problem i’ll be really glad to see them.

Update 3:
Problem solved. Thanks to Mihai Parparita for his answer.

Answer 1

You’ll need to use a media-src 'self' filesystem: CSP directive in order to allow filesystem: URLs ('self' only includes URLs directly in your extension, not wrapped filesystem: ones).