Fix iframe security policy directives for viewing isolate content

appengine/isolate/handlers_frontend.py

 # Copyright 2012 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """This module defines Isolate Server frontend url handlers."""
 
 import cgi
 import datetime
 import json
 import logging
@@ skipping 187 matching lines @@
     # Check for existence of element, so we can 400/404
     if digest and namespace:
       try:
         model.get_content(namespace, digest)
       except ValueError:
         self.abort(400, 'Invalid key')
       except LookupError:
         self.abort(404, 'Unable to retrieve the entry')
     self.response.write(template.render('isolate/browse.html', params))
 
+  def get_content_security_policy(self):
+    csp = super(BrowseHandler, self).get_content_security_policy()
+    csp.setdefault('child-src', []).append("'self'")
+    return csp
+
 
 class ContentHandler(auth.AuthenticatingHandler):
   @auth.autologin
   @auth.require(acl.isolate_readable)
   def get(self):
     namespace = self.request.get('namespace', 'default-gzip')
     digest = self.request.get('digest', '')
     content = None
 
     if digest and namespace:
@@ skipping 189 matching lines @@
 def create_application(debug):
   """Creates the url router.
 
   The basic layouts is as follow:
   - /restricted/.* requires being an instance administrator.
   - /stats/.* has statistics.
   """
   acl.bootstrap()
   template.bootstrap()
   return webapp2.WSGIApplication(get_routes(), debug=debug)