Only allow blob URLs in restricted tags

www/common/diffMarked.js

@@ -358,7 +358,7 @@ define([
     // Only allow iframe, video and audio with local source
     var checkSrc = function (root) {
         if (restrictedTags.indexOf(root.nodeName.toUpperCase()) === -1) { return true; }
-        return root.getAttribute && /^(blob\:|\/)/.test(root.getAttribute('src'));
+        return root.getAttribute && /^blob\:/.test(root.getAttribute('src'));
     };
 
     var removeForbiddenTags = function (root) {