How should javascript: navigations interact with CSP?

[bzbarsky]

Given a navigation to a javascript: URL that returns a string, what should the CSP of the result be, if anything? Per spec right now it has no CSP, but it would make a lot more sense to me to pick up the CSP of ... well, I'm not sure. The content is coming from some combination of the "source browsing context" and the "active document" at the point when we did the evaluation (script comes from source, evaluates against active document's global), the URL comes from the active document, the origin comes from the active document.

@mikewest

[annevk]

Given <IFRAME SRC=javascript:alert(origin)></iframe> and <IFRAME SRC=javascript:alert(document.baseURI)></iframe> I think it would make sense if it inherited all those things from the same place. So wherever it got the origin and base URL from it would also get the CSP from.