import { Link, MediaType, Publication, ReadingProgression } from "@readium/shared"; import { Injector } from "../../injection/Injector.ts"; import { getScriptMode } from "../../helpers/scriptMode.ts"; const csp = (domains: string[]) => { const d = domains.join(" "); return [ // 'self' is useless because the document is loaded from a blob: URL `upgrade-insecure-requests`, `default-src ${d} blob:`, `connect-src 'none'`, // No fetches to anywhere. TODO: change? `script-src ${d} blob: 'unsafe-inline'`, // JS scripts `style-src ${d} blob: 'unsafe-inline'`, // CSS styles `img-src ${d} blob: data:`, // Images `font-src ${d} blob: data:`, // Fonts `object-src ${d} blob:`, // Despite not being recommended, still necessary in EPUBs for `child-src ${d}`, //