pub const CSP: &str = "default-src 'none'; img-src file: data: blob:; media-src file: data: blob:; font-src file: data:; \
style-src file: data: 'unsafe-inline'; script-src file: 'unsafe-inline' 'unsafe-eval'; frame-src file: data:; \
child-src file: data:; object-src 'none'; connect-src 'none'; form-action 'none'";Expand description
The policy put at the top of every unpacked page: the archive’s own files and inline data load, the network doesn’t.