fix: CSP img-src 放行 blob:，修复验证码图片被拦截

登录页验证码用 URL.createObjectURL 生成的 blob: URL 显示，被 img-src 'self' data: 拦截导致图片无法加载；五处 CSP 定义（waf 边缘 + 四个 Flask 中间件副本）同步放宽。

ai_review/security_middleware.py

@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"

db/security_middleware.py

@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"

dnfs/security_middleware.py

@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"

static/security_middleware.py

@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"

waf/internal/proxy/proxy.go

@@ -72,7 +72,7 @@ func setSecurityHeaders(h http.Header) {
 	h.Set("Strict-Transport-Security", "max-age=15552000")
 	h.Set("Content-Security-Policy",
 		"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
-			"img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
+			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
 }
 
 // ServeHTTP 实现 http.Handler。