thanks for the reply and your testing.
i will apply this 2 types of whitelist; strict and tab.
on strict only resouces in the whitelist will be allowed
and on tab, all resources loaded under this tab url will be allowed.