我尝试添加frame-scr，因为它说“注意'frame-src'没有显式设置”：以下是我尝试添加的内容：

frame-src 'self';
frame-src 'self' data:;
frame-src http://example.com/;
frame-src http://* https://*;

仍然错误，我已经改变了框架源代码很多次，并没有任何运气修复错误。
以下是我的Content-Security-Policy：

default-src 'self' data: ; object-src 'none'; frame-ancestors 'self'; sandbox allow-forms allow-same-origin allow-scripts; base-uri 'self';"

下面是我的HTML：

<div id="main">
     <a href="" id="link">Click me</a><br>
</div>
<div id="popup"><iframe id="popupiframe"></iframe></div>
<div id="popupdarkbg"></div>

以下是我的JS：

document.getElementById("link").onclick = function (e) {
    e.preventDefault();
    document.getElementById("popupdarkbg").style.display = "block";
    document.getElementById("popup").style.display = "block";
    document.getElementById('popupiframe').src = "http://example.com/";
    document.getElementById('popupdarkbg').onclick = function () {
        document.getElementById("popup").style.display = "none";
        document.getElementById("popupdarkbg").style.display = "none";
    };
    return false;
}

window.onkeydown = function (e) {
    if (e.keyCode == 27) {
        document.getElementById("popup").style.display = "none";
        document.getElementById("popupdarkbg").style.display = "none";
        e.preventDefault();
        return;
    }
}

我遇到这个错误时，我点击按钮/文本将触发iframe，将显示另一个网站在iframe。

Refused to frame 'http://example.com/' because it violates the following Content Security Policy directive: "default-src 'self' www.gravatar.com fonts.googleapis.com fonts.gstatic.com". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.