pub const CSP: &str = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; \
img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; \
form-action 'self'; frame-ancestors 'none'";Expand description
Scripts and styles from this origin only, no inline script, fetches and
event streams to this origin only, no plugins, no framing. Inline
styles are allowed: the UI’s dialog and toast components inject
<style> elements at runtime, and a style cannot run code.