I have a Cordova app that transforms some images to base64. This violates CSP with this message:
Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%20encod…E%3C%2Fg%...%3C%2Fsvg%3E' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
According to this answer, I can simply add
data: to my Content-Security-Policy meta, but I would very much like to know, if this is safe?
data: does not specify origin and therefore I fear it's unsafe.