echo-allow-csp-from.py | Explore in Territory

import json
def main(request, response):
    headers = [(b"Content-Type", b"text/html")]
    if b"allow_csp_from" in request.GET:
        headers.append((b"Allow-CSP-From", request.GET[b"allow_csp_from"]))
    message = request.GET[b"id"]
    return headers, b'''
<!DOCTYPE html>
<html>
<head>
    <title>This page enforces embedder's policies</title>
    <script nonce="123">
        document.addEventListener("securitypolicyviolation", function(e) {
            var response = {};
            response["id"] = "%s";
            response["securitypolicyviolation"] = true;
            response["blockedURI"] = e.blockedURI;
            response["lineNumber"] = e.lineNumber;
            window.top.postMessage(response, '*');
        });
    </script>
</head>
<body>
    <script nonce="123">
        let img = document.createElement('img');
        img.src = "../../support/pass.png";
        img.onload = function() { window.top.postMessage("img loaded", '*'); }
        document.body.appendChild(img);
    </script>
    <style>
        body {
            background-color: maroon;
        }
    </style>
    <script nonce="123">
        var response = {};
        response["id"] = "%s";
        response["loaded"] = true;
        window.top.postMessage(response, '*');
    </script>
    <script>
        // Inline script which might be blocked by CSP.
        navigator.userAgent;
    </script>
</body>
</html>
''' % (message, message)

chromium/third_party/blink/web_tests/external/wpt/content-security-policy/embedded-enforcement/support/echo-allow-csp-from.py