title: Content-Security-Policy (CSP): how to allow svg image in object
body: <p>I am using the js plugin that adds inside itself SVG images.
  I have added CSP policy to my website, but I can't configure it to allow plugin's code.</p>
  
  <p>Its code looks like:</p>
  
  <pre><code>label=$("&lt;object style='height:10px; width:10px;' type='image/svg+xml' data='data:image/svg+xml;charset=UTF-8," +
  "&lt;svg xmlns=\"http://www.w3.org/2000/svg\"&gt;" +
  "&lt;rect x=\"0\" y=\"0\" some parameters/&gt;"+
  "&lt;text&gt;SomeText&lt;/text&gt;&lt;/svg&gt;'&gt;&lt;/object&gt;");
  el.html(label)
  </code></pre>
  
  <p>I am looking for a configuration that allows SVG image that is rendered in the object.
  I am tried different options from there - <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src" rel="noreferrer">CSP: object-src</a>.</p>
  
  <p>But I am alway get error like next:</p>
  
  <pre><code>Refused to load plugin data from 'data:image/svg+xml;charset=UTF-8, my svg here' because it violates the following Content Security Policy directive: "object-src 'unsafe-eval'".
  </code></pre>
  
  <p>How to configure CSP correct in this case?</p>