So, having just upgraded to XF2, I was unable to drag and drop / paste an image into the editor (Attach files button worked).
Looking in the Chrome console, it was reporting that blob: was being blocked, as I wasn't allowing this in the CSP string
img-src 'self' blob: data:
Adding blob: into...