Issue 4953 - Ensure website isn't whitelisted before injecting CSP

lib/csp.js

Index: lib/csp.js
diff --git a/lib/csp.js b/lib/csp.js
index d4e8ac3b7cdb7b1bc3163601adb45dc3afcfc9c3..6da7132ef7b0b717a726ed7fea6ed870ca44e050 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -20,13 +20,16 @@
 const {defaultMatcher} = require("matcher");
 const {BlockingFilter, RegExpFilter} = require("filterClasses");
 const {getDecodedHostname} = require("url");
+const {checkWhitelisted} = require("whitelisting");
 
 chrome.webRequest.onHeadersReceived.addListener(details =>
 {
   let hostname = getDecodedHostname(new URL(details.url));
   let match = defaultMatcher.matchesAny("", RegExpFilter.typeMap.WEBSOCKET,
                                         hostname, false, null, true);
-  if (match instanceof BlockingFilter)
+  if (match instanceof BlockingFilter &&
+      !checkWhitelisted(new ext.Page({id: details.tabId}),
+                        ext.getFrame(details.tabId, details.frameId)))
   {
     details.responseHeaders.push({
       name: "Content-Security-Policy",