fix: Fix web worker creation within spec frame (#27313)

cli/CHANGELOG.md

@@ -6,6 +6,7 @@ _Released 07/18/2023 (PENDING)_
 **Bugfixes:**
 
 - Fixed an issue where `cy.writeFile()` would erroneously fail with the error `cy.writeFile() must only be invoked from the spec file or support file`. Fixes [#27097](https://github.com/cypress-io/cypress/issues/27097).
+- Fixed an issue where web workers could not be created within a spec. Fixes [#27298](https://github.com/cypress-io/cypress/issues/27298).
 
 ## 12.17.1
 

packages/driver/cypress/e2e/e2e/privileged_commands.cy.ts

@@ -132,6 +132,21 @@ describe('privileged commands', () => {
       `)
     })
 
+    it('allows web workers in spec frame', () => {
+      const workerScript = `postMessage('hello from worker')`
+      const blob = new Blob([workerScript], { type: 'application/javascript' })
+      const workerURL = URL.createObjectURL(blob)
+      const worker = new Worker(workerURL)
+
+      return new Promise<void>((resolve) => {
+        worker.onmessage = ({ data }) => {
+          expect(data).to.equal('hello from worker')
+
+          resolve()
+        }
+      })
+    })
+
     it('passes in test body .then() callback', () => {
       cy.then(() => {
         cy.exec('echo "hello"')

packages/driver/src/util/privileged_channel.ts

@@ -10,7 +10,7 @@ export function setSpecContentSecurityPolicy (specWindow) {
   const metaEl = specWindow.document.createElement('meta')
 
   metaEl.setAttribute('http-equiv', 'Content-Security-Policy')
-  metaEl.setAttribute('content', `script-src 'unsafe-eval'`)
+  metaEl.setAttribute('content', `script-src 'unsafe-eval'; worker-src * data: blob: 'unsafe-eval' 'unsafe-inline'`)
   specWindow.document.querySelector('head')!.appendChild(metaEl)
 }