Merge pull request #985 from SISheogorath/fix/helmetCSP

Add `data:` URL to CSP and upgrade helmet

lib/csp.js

@@ -9,7 +9,7 @@ var defaultDirectives = {
   // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
   imgSrc: ['*'],
   styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
-  fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'],
+  fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'],
   objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
   mediaSrc: ['*'],
   childSrc: ['*'],