Function csp 

pub fn csp() -> &'static str

The content-security policy every page carries. Scripts come from this origin and from nowhere else; the one inline script is allowed by the digest of its own bytes, so an injected inline script is refused even if one ever got through the escaping. No unsafe-eval, no remote origin, and nothing may frame the page.

style-src allows unsafe-inline and script-src does not, which is the one asymmetry here and it is deliberate. A drawing library sets style attributes on the elements it creates — that is how Cytoscape sizes its canvas — and a policy that forbids them makes the optional views silently misrender rather than fail. The exposure is a style injection, which needs the escaping to have already failed and which cannot execute; the exposure script-src 'unsafe-inline' would carry is arbitrary code, and that stays shut.

The digest is computed from view::theme_bootstrap() itself, so the policy cannot drift from the script it allows.

let policy = majordomus_cli::cockpit::csp();
assert!(policy.starts_with("default-src 'none'"));
assert!(!policy.contains("unsafe-eval"));