Content-Security-Policy: default-src 'self' https: data: blob:; frame-src * blob: about: data: mailto:; frame-ancestors * 'self' blob: about: data:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' blob: *.ariba.com *.sap.com *.cloud.sap *.hana.ondemand.com *.qualtrics.com *.sapanalytics.cloud *.sapariba.cn *.mxpnl.com *.sap-enable-now.cn *.go-mpulse.net *.google.com *.fontawesome.com *.applearn.tv *.whatfix.com *.unpkg.com *.gstatic.com *.scriptcdn.net *.infird.com *.cloudfront.net *.threatpulse.com *.uc.cn *.jsdelivr.net *.walkmeqa.com *.okta.com *.microsoftonline.com *.akamaihd.net *.sapbusinessobjects.cloud *.adobetm.com *.bootstrapcdn.com *.cloudflare.com *.jquery.com *.atlassian.com *.trustarc.com; script-src-elem 'self' https: 'unsafe-inline' 'unsafe-eval' blob: *.ariba.com *.sap.com *.cloud.sap *.hana.ondemand.com *.qualtrics.com *.sapanalytics.cloud *.sapariba.cn *.mxpnl.com *.sap-enable-now.cn *.go-mpulse.net *.google.com *.fontawesome.com *.applearn.tv *.whatfix.com *.unpkg.com *.gstatic.com *.scriptcdn.net *.infird.com *.cloudfront.net *.threatpulse.com *.uc.cn *.jsdelivr.net *.bluecoat.com  *.microsoftonline.com *.checkpoint.com *.walkmeqa.com *.okta.com *.pepsico.com *.airbus.corp *.googleapis.com *.akamaihd.net *.sapbusinessobjects.cloud *.adobetm.com *.bootstrapcdn.com *.cloudflare.com *.jquery.com *.atlassian.com *.trustarc.com; style-src * 'unsafe-inline' blob:; style-src-elem * 'unsafe-inline' blob:; img-src * https: data: blob: file:; connect-src * https: wss: data: blob: javascript:; worker-src 'self' blob:; font-src * data: blob:; report-uri https://aribacsp.report-uri.com/r/t/csp/enforce;