Bawolff added a comment.
So if I was ignoring polestar (aka graph builder mode) the ideal CSP would be something like: default-src 'self' data:; style-src 'unsafe-inline' data: 'self'; img-src data: 'self' upload.wikimedia.org commons.wikimedia.org; media-src data: 'self' upload.wikimedia.org commons.wikimedia.org; script-src 'report-sample' https://query.wikidata.org/js/ blob:; connect-src meta.wikimedia.org www.wikidata.org 'self'; object-src 'none'; report-uri https://www.wikidata.org/w/api.php?action=cspreport&format=none TASK DETAIL https://phabricator.wikimedia.org/T238618 EMAIL PREFERENCES https://phabricator.wikimedia.org/settings/panel/emailpreferences/ To: Bawolff Cc: Lucas_Werkmeister_WMDE, Aklapper, Bawolff, darthmon_wmde, DannyS712, Nandana, Lahi, Gq86, GoranSMilovanovic, QZanden, EBjune, merbst, LawExplorer, Salgo60, _jensen, rosalieper, Scott_WUaS, Jonas, Xmlizer, jkroll, Smalyshev, Wikidata-bugs, Jdouglas, aude, Tobias1984, Manybubbles, Lydia_Pintscher, Mbch331
_______________________________________________ Wikidata-bugs mailing list Wikidata-bugs@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikidata-bugs