Fix iframe security policy directives for viewing isolate content

appengine/isolate/handlers_frontend.py

Index: appengine/isolate/handlers_frontend.py
diff --git a/appengine/isolate/handlers_frontend.py b/appengine/isolate/handlers_frontend.py
index 5b72d8fc03ba6540230383f5878082325292fe6b..9d0d2c80bbb2d6e627ab1b6eb0c9ad09891959a2 100644
--- a/appengine/isolate/handlers_frontend.py
+++ b/appengine/isolate/handlers_frontend.py
@@ -205,6 +205,11 @@ class BrowseHandler(auth.AuthenticatingHandler):
         self.abort(404, 'Unable to retrieve the entry')
     self.response.write(template.render('isolate/browse.html', params))
 
+  def get_content_security_policy(self):
+    csp = super(BrowseHandler, self).get_content_security_policy()
+    csp.setdefault('child-src', []).append("'self'")
+    return csp
+
 
 class ContentHandler(auth.AuthenticatingHandler):
   @auth.autologin