code: function(policyObject, name, sourceList) {
    var oldSourceList;
    var oldValue = policyObject[name];
  
    // cast string syntax into array
    if (oldValue && typeof oldValue === 'string') {
      oldValue = oldValue.split(' ');
    }
  
    if (oldValue !== null && typeof oldValue !== 'undefined' && !Array.isArray(oldValue)) {
      throw new Error('Unknown source list value');
    }
  
    if (!oldValue || oldValue.length === 0) {
      // copy default-src (see above)
      oldSourceList = policyObject['default-src'] || [];
    } else { // array
      oldSourceList = oldValue;
    }
  
    oldSourceList.push(sourceList);
    policyObject[name] = oldSourceList.join(' ');
  }
docs: CSP has a built-in fallback mechanism. If, say, `connect-src` is not defined it will fall back to `default-src`. This can cause issues. An example:  Developer has has defined the following policy: `default-src: 'self' example.com;` and an addon appends the connect-src entry live-reload.local the result is: `default-src: 'self' example.com; connect-src: live-reload.local;`  After the addons change an xhr to example.com (which was previously permitted, via fallback) will now be rejected since it doesn't match live-reload.local.  To mitigate, whenever we append to a non-existing directive we must also copy all sources from default-src onto the specified directive.