Figure out how to sanitize the blob URL

[asamuzaK]

Unlike data URLs, blob URLs are only references to the objects and contain no clues about the actual objects.
Therefore, it is not possible to sanitize them from just the URL strings.

In the current implementation of URL Sanitizer, blob URLs are disabled by default, but when enabled, URLs are simply passed as a no-op.

There has been some discussion about the specification of blob URLs.
Refs.

• Eliminating XSS from WebUI with Trusted Types | Microsoft Browser Vulnerability Research
• "Null"ing out the Origin of a BLOB · Issue #74 · w3c/FileAPI
• Should fetches to blob URLs be more restricted? · Issue #666 · whatwg/fetch
• Put policies in the blob URL store · Issue #142 · w3c/FileAPI

Consider how to sanitize blob URLs according to these discussions.

[asamuzaK]

Ref buffer.resolveObjectURL(id)
Looks like Node.js can get source and MIME type.