Javascript 'img-src' 未明确设置，因此使用 'default-src' 作为后备
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/32166870/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
'img-src' was not explicitly set, so 'default-src' is used as a fallback
提问by Manish Kumar
Here is my Content-Security-Policyin index.html
这是我Content-Security-Policy的index.html
<meta http-equiv="Content-Security-Policy" content="default-src 'self' http://example.com">
Now i am dynamically setting img src of <img id="updateProfilePicPreview" class="profilPicPreview" src="" />as
现在我正在动态设置 img src <img id="updateProfilePicPreview" class="profilPicPreview" src="" />as
var smallImage = document.getElementById('updateProfilePicPreview');
smallImage.style.display = 'block';
smallImage.src = "data:image/jpeg;base64," + imageData;
It shows
表明
Refused to load the image 'data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygw…p+tB/yaKKAIi2TSfjRRVCJFOyIk96rE5NFFDGgoooqBhRRRQA9elIDg5oopgIc+lFFFAH/2Q==' because it violates the following Content Security Policy directive: "default-src 'self' http://example.com". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
拒绝加载图像 'data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygw...p+tB/yaKKAIi2TSfjRRVCJFOyIk96rE5NFFDGgoooqBhRRRQA9elIDgs 违反了以下指令：安全性它的默认值==安全策略+FFCFAGHQIcfcfdggoooqBhRRRQA9elIDgs== http://example.com”。请注意，'img-src' 未明确设置，因此使用 'default-src' 作为后备。
So how can i enable setting imgsrc dynamically ?
那么如何启用img动态设置src 呢？
I was following this example from cordova page:
我正在从cordova页面关注这个例子：
var pictureSource; // picture source
var destinationType; // sets the format of returned value
// Wait for device API libraries to load
//
document.addEventListener("deviceready",onDeviceReady,false);
// device APIs are available
//
function onDeviceReady() {
pictureSource=navigator.camera.PictureSourceType;
destinationType=navigator.camera.DestinationType;
}
// Called when a photo is successfully retrieved
//
function onPhotoDataSuccess(imageData) {
// Uncomment to view the base64-encoded image data
// console.log(imageData);
// Get image handle
//
var smallImage = document.getElementById('smallImage');
// Unhide image elements
//
smallImage.style.display = 'block';
// Show the captured photo
// The in-line CSS rules are used to resize the image
//
smallImage.src = "data:image/jpeg;base64," + imageData;
}
// Called when a photo is successfully retrieved
//
function onPhotoURISuccess(imageURI) {
// Uncomment to view the image file URI
// console.log(imageURI);
// Get image handle
//
var largeImage = document.getElementById('largeImage');
// Unhide image elements
//
largeImage.style.display = 'block';
// Show the captured photo
// The in-line CSS rules are used to resize the image
//
largeImage.src = imageURI;
}
// A button will call this function
//
function capturePhoto() {
// Take picture using device camera and retrieve image as base64-encoded string
navigator.camera.getPicture(onPhotoDataSuccess, onFail, { quality: 50,
destinationType: destinationType.DATA_URL });
}
// A button will call this function
//
function capturePhotoEdit() {
// Take picture using device camera, allow edit, and retrieve image as base64-encoded string
navigator.camera.getPicture(onPhotoDataSuccess, onFail, { quality: 20, allowEdit: true,
destinationType: destinationType.DATA_URL });
}
// A button will call this function
//
function getPhoto(source) {
// Retrieve image file location from specified source
navigator.camera.getPicture(onPhotoURISuccess, onFail, { quality: 50,
destinationType: destinationType.FILE_URI,
sourceType: source });
}
// Called if something bad happens.
//
function onFail(message) {
alert('Failed because: ' + message);
}
回答by Quentin
So how can i enable setting img src dynamically ?
那么如何启用动态设置 img src 呢？
The problem is not setting the src, the problem is setting the src to a data: scheme URI.
问题不在于设置 src，问题在于将 src 设置为 data: 方案 URI。
Add data:to the list of things allowed by the content security policy. Either for the default-src or you could define a separate img-src.
添加data:到内容安全策略允许的列表中。对于 default-src，或者您可以定义一个单独的 img-src。
In the example below, I have added img-src 'self' data:;to the start of the meta tag in the index.html file.
在下面的示例中，我已添加img-src 'self' data:;到 index.html 文件中元标记的开头。
<meta http-equiv="Content-Security-Policy" content="img-src 'self' data:; default-src 'self' http://XX.XX.XX.XX:8084/mypp/">
