---
whitelist:
script-src-elem:
- https://cdn.jsdelivr.net # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://kit.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://code.jquery.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://unpkg.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
style-src-elem:
- https://cdn.jsdelivr.net # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://cdnjs.cloudflare.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
font-src:
- https://cdnjs.cloudflare.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://cdn.jsdelivr.net # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
connect-src:
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://cdn.jsdelivr.net # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
frame-ancestors:
- "*"
flags:
style-src-attr:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
