relax content security policy

Author: Yann Leflour

ui-sketcher-extension/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## [1.1.3] - 2023-23-09
+
+## Fixed
+
+- Allow pasting images from clipboard
+- Allow embeddings from urls
+
 ## [1.1.2] - 2023-22-09
 
 ### Fixed

ui-sketcher-extension/src/ui-sketcher.html

@@ -9,7 +9,7 @@
     -->
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'none'; img-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline'; style-src <%= cspSource %> 'unsafe-inline'; script-src 'nonce-<%= nonce %>'; connect-src https://unpkg.com/@tldraw/; frame-src <%= previewHost %>/;"
+      content="default-src 'none'; img-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline'; style-src <%= cspSource %> 'unsafe-inline'; script-src 'nonce-<%= nonce %>' 'unsafe-eval'; connect-src https://unpkg.com/@tldraw/ blob: data:; media-src blob: data:; frame-src *;"
     />
 
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />