chromium/third_party/blink/web_tests/http/tests/inspector-protocol/page/resources/csp-frame-src.php

<?php
ob_start();
header("Content-Security-Policy: default-src 'self'; frame-src block-everything.com");
echo "<iframe src='http://127.0.0.1:8000/inspector-protocol/page/resources/csp.php'>";