tobago-example/tobago-example-demo/src/main/webapp/WEB-INF/tobago-config.xml

<?xml version="1.0" encoding="UTF-8"?>

<!--
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
-->

<tobago-config
    xmlns="http://myfaces.apache.org/tobago/tobago-config"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://myfaces.apache.org/tobago/tobago-config http://myfaces.apache.org/tobago/tobago-config-5.0.xsd"
    version="5.0">

  <name>demo</name>

  <ordering>
    <after>
      <name>tobago-theme-standard</name>
      <name>tobago-theme-speyside</name>
      <name>tobago-theme-charlotteville</name>
      <name>tobago-theme-roxborough</name>
      <name>tobago-theme-scarborough</name>
    </after>
  </ordering>

<!-- using all available themes, if this is not set XXX to be implemented TOBAGO-1664 -->
  <theme-config>
    <default-theme>standard</default-theme>
    <supported-theme>scarborough</supported-theme>
    <supported-theme>speyside</supported-theme>
    <supported-theme>roxborough</supported-theme>
    <supported-theme>charlotteville</supported-theme>
  </theme-config>

  <!-- This is needed for the testing functionality of the demo, it works with iframes -->
  <prevent-frame-attacks>false</prevent-frame-attacks>

  <content-security-policy mode="on">
    <!-- script-src: 'unsafe-inline' is required for WebSockets -->
<!--    <directive name="script-src">'unsafe-inline'</directive>-->
    <!-- needed for <tc:object>  -->
    <directive name="child-src">https://www.openstreetmap.org</directive>
    <directive name="child-src">https://*.apache.org</directive>
    <!-- needed for the test suite -->
    <directive name="child-src">'self'</directive>
    <!-- needed for the test suite -->
    <directive name="frame-ancestors">'self'</directive>
  </content-security-policy>

  <!-- "disable" is the default -->
  <!--<security-annotation>disable</security-annotation>-->

<!-- this is the default...
  <sanitizer>
    <sanitizer-class>org.apache.myfaces.tobago.sanitizer.JsoupSanitizer</sanitizer-class>
    <properties>
      &lt;!&ndash;
       Use one of: basic, basicWithImages, relaxed, simpleText or none
       &ndash;&gt;
      <entry key="whitelist">relaxed</entry>
    </properties>
  </sanitizer>
-->

  <!-- true is the default -->
  <!--<decode-line-feed>false</decode-line-feed>-->

</tobago-config>