<html>
<head>
  <meta charset="utf-8">
  <meta http-equiv="Content-Security-Policy" content="frame-src https://example.com; child-src 'none'">";
</head>
<body>
<iframe id="testframe"></iframe>
<script type="text/javascript" src="file_frame_src.js"></script>
</body>
</html>
