update csp

web/svelte.config.js

@@ -17,7 +17,20 @@ export default {
 		csp: {
 			mode: 'hash',
 			directives: {
-				'script-src': ['self']
+				'default-src': ['self'],
+				'script-src': ['self'],
+				'style-src': ['self', 'unsafe-inline'],
+				'img-src': ['self', 'data:', 'blob:'],
+				'media-src': ['self', 'blob:'],
+				'font-src': ['self', 'data:'],
+				'connect-src': ['self'],
+				'manifest-src': ['self'],
+				'worker-src': ['self'],
+				'object-src': ['none'],
+				'base-uri': ['self'],
+				'frame-ancestors': ['none'],
+				'form-action': ['self'],
+				'upgrade-insecure-requests': true
 			}
 		},
 		alias: {