参考：
相关文章
- 漏洞修复：检测到目标Content-Security-Policy响应头缺失
- 内容安全策略CSP（Content-Security-Policy）
- 内容安全策略（content-security-policy）
- Vue踩坑-because it violates the following Content Security Policy directive
- options.html:1 Refused to load the script 'xxxx' because it violates the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:".
- firefox和chrome对于favicon.ico关于content-security-policy的不同处理
- Content Security Policy 入门教程
- DVWA 黑客攻防实战（十五） 绕过内容安全策略 Content Security Policy (CSP) Bypass
- because it violates the following Content Security Policy directive: "default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'". Note that 'script-src' was not explicitly set, so 'default-s