content_security_policy.dict

### dom/security/nsCSPParser.cpp
# tokens
":"
";"
"/"
"+"
"-"
"."
"_"
"~"
"*"
"'"
"#"
"?"
"%"
"!"
"$"
"&"
"("
")"
"="
"@"

### https://www.w3.org/TR/{CSP,CSP2,CSP3}/
# directive names
"default-src"
"script-src"
"object-src"
"style-src"
"img-src"
"media-src"
"frame-src"
"font-src"
"connect-src"
"report-uri"
"frame-ancestors"
"reflected-xss"
"base-uri"
"form-action"
"manifest-src"
"upgrade-insecure-requests"
"child-src"
"block-all-mixed-content"
"require-sri-for"
"sandbox"
"worker-src"
"plugin-types"
"disown-opener"
"report-to"

# directive values
"'self'"
"'unsafe-inline'"
"'unsafe-eval'"
"'none'"
"'strict-dynamic'"
"'unsafe-hashed-attributes'"
"'nonce-AA=='"
"'sha256-fw=='"
"'sha384-/w=='"
"'sha512-//8='"

# subresources
"a"
"audio"
"embed"
"iframe"
"img"
"link"
"object"
"script"
"source"
"style"
"track"
"video"

# sandboxing flags
"allow-forms"
"allow-pointer-lock"
"allow-popups"
"allow-same-origin"
"allow-scripts"
"allow-top-navigation"

# URI components
"https:"
"ws:"
"blob:"
"data:"
"filesystem:"
"javascript:"
"http://"
"selfuri.com"
"127.0.0.1"
"::1"


# Copyright 2016 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

" "
","
"self"
"//"
"*"
"www"
".example.com"
":443"
"/path/to/resource"
"'none'"
"'self'"
"'strict-dynamic'"
"'unsafe-inline'"
"'unsafe-eval'"

"allow-forms"
"allow-scripts"
"base-uri"
"block-all-mixed-content"
"child-src"
"connect-src"
"default-src"
"font-src"
"form-action"
"frame-ancestors"
"frame-src"
"img-src"
"manifest-src"
"media-src"
"object-src"
"plugin-types"
"report-to"
"report-uri"
"require-sri-for"
"sandbox"
"script-src"
"style-src"
"treat-as-public-address"
"upgrade-insecure-requests"
"application/octet-stream"