google-chrome - 带有CSP img-src的Chrome浏览器*仍会阻止图像

Question

我的web应用程序有一个内容安全策略，该策略将img-src设置为*(可从任何位置加载图像)，但Chrome仍会阻止某些图像加载...

Refused to load the image 'data:image/webp;base64,UklGRhoAAABXRUJQVlA4TA0AAAAvAAAAEAcQERGIiP4HAA==' because it violates the following Content Security Policy directive: "img-src *". lg @ js?libraries=places,geometry&v=3&callback=async_req_1:84(anonymous function) @ js?libraries=places,geometry&v=3&callback=async_req_1:119google.maps.Load @ js?libraries=places,geometry&v=3&callback=async_req_1:21(anonymous function) @ js?libraries=places,geometry&v=3&callback=async_req_1:118(anonymous function) @ js?libraries=places,geometry&v=3&callback=async_req_1:119

如果我在指令中包含“data:”，则错误不会显示在控制台中。

img-src *数据:;

但是，这不是有效的指令。是否存在一个可以满足Chrome要求的img-src有效CSP值，或者这可能是Chrome错误？我无法在可访问的错误列表中找到任何直接匹配项。我推测这可能与SVG文件中嵌入的图像有关。 Firefox和Safari不会出现此行为。

Answer 1

content-security-policy.com错误。参见w3.org/TR/CSP2/#source-list-guid-matching。

As defined above, special URL schemes that refer to specific pieces of unique content, such as "data:", "blob:" and "filesystem:" are excluded from matching a policy of * and must be explicitly listed.

*也不包含“不安全内联”或“不安全评估”。