Version banner, File locations section, final CSP (no unsafe-inline styles, frame-src none, object-src none)

The MTR viewer draws PDFs with pdf.js instead of an iframe the server's frame-ancestors refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/server/test_app.py

@@ -29,19 +29,21 @@ def _assert_headers(r) -> None:  # type: ignore[no-untyped-def]
     for k, v in EXPECTED.items():
         assert r.headers.get(k) == v, k
     csp = r.headers["content-security-policy"]
-    for part in (
+    assert [p.strip() for p in csp.split(";")] == [
         "default-src 'self'",
         "script-src 'self'",
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' data: blob:",
+        "style-src 'self'",
+        "img-src 'self' blob:",
         "font-src 'self'",
         "connect-src 'self'",
-        "worker-src 'self' blob:",
+        "worker-src 'self'",
+        "frame-src 'none'",
+        "object-src 'none'",
         "frame-ancestors 'none'",
         "base-uri 'self'",
         "form-action 'self'",
-    ):
-        assert part in csp
+    ]
+    assert "unsafe-inline" not in csp and "unsafe-eval" not in csp
     assert csp == security.CSP