Allow inline images (data: URLs) in the default CSP

ai_web_common/flask_ai/app.py

@@ -23,6 +23,10 @@ def init_app(app, talisman):
         app,
         frame_options=DENY,
         referrer_policy='no-referrer',
+        content_security_policy={
+            'default-src': '\'self\'',
+            'img-src': ['\'self\'', 'data:'],
+        },
         content_security_policy_report_uri=app.config.get(
             'CSP_REPORT_URI', DEFAULT_CSP_REPORT_URI),
         force_https=not app.config['TESTING'],