feat: Add option to add CSP to the replay iframe

[KristianGrafana]

This PR adds support to add a Content-Security-Policy to the iframe. This is if users want to further tighten the security of the iframe by being able to block images, videos, objects, iframes and more.

Let me know if you have any questions!

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4016cb3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This PR attempts to add Content Security Policy (CSP) support to the replay iframe to allow users to tighten security by blocking images, videos, objects, iframes, and other content types.

Key Changes:

• Added optional csp configuration parameter to the playerConfig type
• Implemented CSP application logic in the setupDom method of the Replayer class

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
packages/rrweb/src/types.ts	Adds optional csp?: string property to playerConfig type definition
packages/rrweb/src/replay/index.ts	Implements CSP application by setting the csp attribute on the replay iframe element

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[Juice10]

Hi @KristianGrafana, thanks for this addition. Since the csp attribute is lacking some major browser support it would be good to document this so people who use it don't get a false sense of security. And in general it would be good to document this feature in the Guide.md and rrweb-player readme files