iframe_meta.sub.html (415B)
1 <!-- Same as iframe.sub.html, but provides CSP in a meta tag --> 2 <!DOCTYPE html> 3 <html> 4 <meta http-equiv="Content-Security-Policy" content="{{GET[policy]}}"> 5 <body> 6 <script nonce='forinlinescript'> 7 window.addEventListener('securitypolicyviolation', function() { 8 top.postMessage('CSP_VIOLATION', '*'); 9 }); 10 </script> 11 <script src='{{GET[script_url]}}'></script> 12 </body> 13 </html>