pub const WIDGET_CSP: &str = "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; \
style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; media-src 'self' blob:; \
connect-src 'none'; frame-src 'none'; form-action 'none'; base-uri 'none'";Expand description
The policy every widget file is served with (spec §6.1).