Why not to replace all these with just `allow 'self';` ? Looks good and solid default behaviour. Is there any need in external images, fonts, unsafe arbitrary code execution and style inline (you may inline style with JS code to overrun XSS policy)?