Bugs

Note: The plugin-types grammar allows for an empty directive value in which case all instantions of embed and object will fail.

https://w3c.github.io/webappsec-csp/#directive-plugin-types

We validate it must match something like application/pdf which is not correct.

Expected outcome

Describe what you expected to happen

plugin_types should allow for an empty directive. Sending an empty array omits the directive. Sending none is not allowed by validation. An array of empty strings doesn't work either (validation)

Actual outcome

Configuration errors when trying to do the right thing