From a5e581ef245bb51909780c94ab334475b54db703 Mon Sep 17 00:00:00 2001
From: qing <1776177662@qq.com>
Date: Tue, 28 Jul 2026 10:19:47 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CSP=20img-src=20=E6=94=BE=E8=A1=8C=20blo?=
 =?UTF-8?q?b:=EF=BC=8C=E4=BF=AE=E5=A4=8D=E9=AA=8C=E8=AF=81=E7=A0=81?=
 =?UTF-8?q?=E5=9B=BE=E7=89=87=E8=A2=AB=E6=8B=A6=E6=88=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

登录页验证码用 URL.createObjectURL 生成的 blob: URL 显示，被 img-src 'self' data: 拦截导致图片无法加载；五处 CSP 定义（waf 边缘 + 四个 Flask 中间件副本）同步放宽。
---
 ai_review/security_middleware.py | 2 +-
 db/security_middleware.py        | 2 +-
 dnfs/security_middleware.py      | 2 +-
 static/security_middleware.py    | 2 +-
 waf/internal/proxy/proxy.go      | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/ai_review/security_middleware.py b/ai_review/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/ai_review/security_middleware.py
+++ b/ai_review/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/db/security_middleware.py b/db/security_middleware.py
index a180e14..7e5ee15 100644
--- a/db/security_middleware.py
+++ b/db/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/dnfs/security_middleware.py b/dnfs/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/dnfs/security_middleware.py
+++ b/dnfs/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/static/security_middleware.py b/static/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/static/security_middleware.py
+++ b/static/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index d5abe66..424b4d7 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -72,7 +72,7 @@ func setSecurityHeaders(h http.Header) {
 	h.Set("Strict-Transport-Security", "max-age=15552000")
 	h.Set("Content-Security-Policy",
 		"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
-			"img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
+			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
 }
 
 // ServeHTTP 实现 http.Handler。