I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically based on markup that we receive from an API. The markup that is returned from the API could have scripts that are not controlled by us. The SPA application will render the markup, including executing the scripts that get returned from the API as part of the markup. The issue here is that a potentially malicious script could get returned from the API, which could hijack user information from the parent SPA application.
In this situation, how do we go about implementing CSP policy for the SPA application? I understand that there might not be a way to restrict hijack without doing some major architecture changes in the way that the content is rendered by the SPA. Any suggestions are welcome.