I'm looking to improve the security of my site with a Content Security Policy. I have set one up for my site in htaccess (using Content-Security-Policy-Report-Only and doing everything possible to iron out what's required and then re-testing with the policy in place). I have good extensions and I'm relatively happy with the theme my site uses but I found that I had to add to my security policy for scripts the following:
script-src 'self' 'unsafe-inline' 'unsafe-eval'
and then to the image policy:
img-src 'self' data:
all my other policies are filled with either 'self' or analytics, google maps or captcha url's, the cdn url and a few extension url's (images in the back end configuration loaded from extension developers sites or site extension validation scripts etc).
What are the risks of 'unsafe-inline', 'unsafe-eval' and data:? How will these effect protection from cross-site attacks and if they do, which ones should I hunt down to get rid of so I can improve my content security policy?