About this question
I have a Cordova app that transforms some images to base64. This violates CSP with this message:
Refused to load the image 'data:image/svg+xml;charset=US-ASCII,<?xml version="1.0" encod…E' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.According to this answer, I can simply add data: to my Content-Security-Policy meta, but I would very much like to know, if this is safe? data: does not specify origin and therefore I fear it's unsafe.