google-maps - 由于内容安全策略 : "Refused to load the image ' data:image/svg+xml. ."，Google map 缩放按钮未加载。"

Question

我的带有 google maps javascript API 对象的站点没有加载大量图像。

Chrome 开发工具删除了这个:

Refused to load the image '<URL>' because it violates the following Content Security Policy directive: "img-src 'self' <URL> <URL> <URL> <URL>".

userone:1 Refused to load the image 'data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2218%22%20height%3D%2218%22%20viewBox%3D%220%20018%2018%22%3E%0A%20%20%3Cpath%20fill%3D%22%23666%22%20d%3D%22M0%2C0v2v4h2V2h4V0H2H0z%20M16%2C0h-4v2h4v4h2V2V0H16z%20M16%2C16h-4v2h4h2v-2v-4h-2V16z%20M2%2C12H0v4v2h2h4v-2H2V12z%22%2F%3E%0A%3C%2Fsvg%3E%0A' because it violates the following Content Security Policy directive: "img-src 'self' https://www.google-analytics.com https://maps.gstatic.com https://*.googleapis.com".

对于页面上的许多图像，此消息一遍又一遍地重复。

Answer 1

通过将 data:image/svg+xml 添加到我的内容安全策略 (CSP) 来修复此问题:

'img-src': ["'self'",
  ...
  'data:',
  ...
]

请注意 data: 是不安全的:

An attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.

来源:MDN: Content Security Policy: img-src