Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow
img-src due to a third-party component. (Both
img-src are otherwise restricted to
self and some hard-coded URLs.)
So, my question is: Is allowing
blob: a general security risk in the sense that an attacker can in an injected script wrap any URL with
blob and thus connect to any arbitrary resource?