tags // (for browsers that do not support https://caniuse.com/mdn-api_shadowroot_adoptedstylesheets) new Mutation(MutationMode::Extend, Directive::StyleSrc, SourceKeyword::unsafeInline), // `style-src-attr 'unsafe-inline'` required for remaining inline styles, which is okay for color & dimension // (e.g. `
` - but NOT having the possibility to use any other assets/files/URIs) new Mutation(MutationMode::Set, Directive::StyleSrcAttr, SourceKeyword::unsafeInline), // allow `data:` images new Mutation(MutationMode::Extend, Directive::ImgSrc, SourceScheme::data), // `frame-src self` required for backend nav and list iframes new Mutation(MutationMode::Extend, Directive::FrameSrc, SourceKeyword::self), // deny `` element which might be used for cross-origin targets new Mutation(MutationMode::Set, Directive::BaseUri, SourceKeyword::none), // deny `` and `` elements new Mutation(MutationMode::Set, Directive::ObjectSrc, SourceKeyword::none), // Allows to fetch media assets from YouTube and Vimeo and their associated CDNs, // to be embedded in an `