<html>
<head>
  <meta charset="utf-8">
  <meta http-equiv="Content-Security-Policy" content="script-src 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='">
</head>
<body>
  <a href="javascript:window.parent.postMessage({}, '*');">Click here</a>
</body>
</html>
