Steps to reproduce

Sorry, I don't have a lot of time to create actual repro steps, but...

If you do something like this:

class ApplicationController < ActionController::Base
  content_security_policy do |policy|
    policy.frame_ancestors lambda { [:self, "https://example.com"] }
  end
end

Then the content-security-policy HTTP header will look like this:

content-security_policy: frame-ancestors self https://example.com

Note that it says self instead of 'self'.

This only happens when you return an array from that lambda. If you return :self it works fine. Also moving :self to outside the lambda (passed directly to frame_ancestors works as expected.

Expected behavior

content-security_policy: frame-ancestors 'self' https://example.com

Actual behavior

content-security_policy: frame-ancestors self https://example.com

System configuration

Rails version: 6.0.4.4 (but I see no diff between the relevant file and main)

Ruby version: 2.6.8