Given the news that php.net was hacked with a malware which worked through an iframe (this is common for malware), this feature which I was considering since a while appears to be a must-have now.

https://arstechnica.com/security/2013/10/hackers-compromise-official-php-website-infect-visitors-with-malware/

So it will be like that:

• Blacklisted types have precedence over whitelisted hostnames (new behavior)
• Blacklisted hostnames have precedence over whitelisted types (stays same as current)

This is a change in behavior. It is a good idea to blacklist iframes in general, but this choice is currently meaningless when whitelisting a specific hostname, as the hostname currently has always priority. So the basic logic will be simple enough to not cause confusion (hopefully) in user's mind:

Whatever is blacklisted by inheritance has precedence over what is whitelisted by inheritance. (hopefully I won't find annoying side effect complication with this new behavior.)