we don't need csp if we assign directly the results of the method 'links(url)' to heap