CSP Bypass

<script>I entered “” like this in the lecture to display an alert, but since the page code itself that gave the param alert (1) on the vuln page is an alert (1), it was imported as it is and became an<script src="/vuln?param=alert(1)"></script> “alert (1)”?</script>

The self attribute is currently known not only for that page, but that domain only allows the same thing. So why don't you dare /vuln? param=/memo? memo= without doing something like this `/memo? Can we solve memo=' + document.cookie 'like this? I did If you do this, the cookie value is not assigned and a blank space is output. Dri

i stuck with this challenge so long, plz give me a hint for this challenge