IIS 设置Content-Security-Policy

default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; sandbox allow-scripts allow-same-origin allow-forms allow-popups allow-modals;