`text/ecmascript` and `application/ecmascript` are also valid values and I think there are more supported content types for javascript execution.

Whitelisting is not an option right?