title: Script-src-elem being reported although script-src is defined
body: <p>Related: <a href="https://stackoverflow.com/questions/64322419/why-is-script-src-elem-not-using-values-from-script-src-as-a-fallback">Why is script-src-elem not using values from script-src as a fallback?</a></p>
  <p>I am seeing a low of CSP reports where e.g. <code>https://track.adform.net/serving/scripts/trackpoint/async/</code> is blocked due to the effective directive <code>script-src-elem</code>. As you can see in the policy below I am not defining <code>script-src-elem</code> but expect it to fall back to <code>script-src</code> or even <code>default-src</code>. That is my in my debugging this policy looks the way it does.</p>
  <p>I have not been able to reproduce the report myself.</p>
  <p>Full report:</p>
  <pre><code>{
      &quot;csp-report&quot;: {
          &quot;document-uri&quot;: &quot;https://www.example.com/some/uri&quot;,
          &quot;effective-directive&quot;: &quot;script-src-elem&quot;,
          &quot;original-policy&quot;: &quot;default-src 'self' data: fonts.gstatic.com *.googleapis.com browser.sentry-cdn.com *.youtube.com i.ytimg.com sentry.io images.prismic.io *.atdmt.com *.adnxs.com *.google.se *.google.com *.facebook.com connect.facebook.net *.hotjar.com hotjar.io *.hotjar.io *.adform.net www.google-analytics.com www.gstatic.com www.googletagmanager.com stats.g.doubleclick.net;script-src 'self' 'unsafe-inline' 'unsafe-eval' data: fonts.gstatic.com *.googleapis.com browser.sentry-cdn.com *.youtube.com i.ytimg.com sentry.io images.prismic.io *.atdmt.com *.adnxs.com *.google.se *.google.com *.facebook.com connect.facebook.net *.hotjar.com hotjar.io *.hotjar.io *.adform.net www.google-analytics.com www.gstatic.com www.googletagmanager.com stats.g.doubleclick.net;style-src 'self' 'unsafe-inline' data: fonts.gstatic.com *.googleapis.com browser.sentry-cdn.com *.youtube.com i.ytimg.com sentry.io images.prismic.io *.atdmt.com *.adnxs.com *.google.se *.google.com *.facebook.com connect.facebook.net *.hotjar.com hotjar.io *.hotjar.io *.adform.net www.google-analytics.com www.gstatic.com www.googletagmanager.com stats.g.doubleclick.net;img-src 'self' * data:;report-uri https://example.report-uri.com/r/d/csp/reportOnly&quot;,
          &quot;blocked-uri&quot;: &quot;https://track.adform.net/serving/scripts/trackpoint/async/&quot;
      }
  }
  </code></pre>
  <p>I am only seeing it in the chrome browser on primarily Windows. There is a bug [1] report in the Chromium tracker but that was closed off without further investigation and seem to affect something else.</p>
  <p>Is there something wrong with my policy or perhaps a bug should be opened in the tracker again?</p>
  <p>[1] <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=880816" rel="nofollow noreferrer">https://bugs.chromium.org/p/chromium/issues/detail?id=880816</a></p>