Values
Each directive can have a list of values representing allowed sources. For example, ScriptSrc can specify multiple external scripts. These values are restricted to 1024 characters and cannot include whitespace, commas, or semicolons. Additionally, single-quoted strings and wildcard characters (*) are disallowed.