Looking into code of app.py we see that filter_url() adds all image urls to img-src policy.```def filter_url(urls):    domain_list = []    for url in urls:        domain = urllib.parse.urlparse(url).scheme + "://" + urllib.parse.urlparse(url).netloc        if domain:            domain_list.append(domain)    return " ".join(domain_list) @app.route('/display/<token>')def display(token):    user_obj = Post.select().where(Post.token == token)    content = user_obj[-1].content if len(user_obj) > 0 else "Not Found"    img_urls = [x['src'] for x in bs(content).find_all("img")]    tmpl = render_template("display.html", content=content)    resp = make_response(tmpl)    resp.headers["Content-Security-Policy"] = "default-src 'none'; connect-src 'self'; img-src " \                                              f"'self' {filter_url(img_urls)}; script-src 'none'; " \                                              "style-src 'self'; base-uri 'self'; form-action 'self' "    return resp```
We just need to inject script-src policty that allows us to execute.
Payload:``````