src/third_party/web_platform_tests/content-security-policy/support/inject-image.js

// This script block will trigger a violation report.
var i = document.createElement('img');
i.src = '/content-security-policy/support/fail.png';
document.body.appendChild(i);
log("TEST COMPLETE");