file_bug888172.html (932B)
1 <!doctype html> 2 <html> 3 <body> 4 <ol> 5 <li id="unsafe-inline-script">Inline script (green if allowed, black if blocked)</li> 6 <li id="unsafe-eval-script">Eval script (green if allowed, black if blocked)</li> 7 <li id="unsafe-inline-style">Inline style (green if allowed, black if blocked)</li> 8 </ol> 9 10 <script> 11 // Use inline script to set a style attribute 12 document.getElementById("unsafe-inline-script").style.color = "green"; 13 14 // Use eval to set a style attribute 15 // try/catch is used because CSP causes eval to throw an exception when it 16 // is blocked, which would derail the rest of the tests in this file. 17 try { 18 // eslint-disable-next-line no-eval 19 eval('document.getElementById("unsafe-eval-script").style.color = "green";'); 20 } catch (e) {} 21 </script> 22 23 <style> 24 li#unsafe-inline-style { 25 color: green; 26 } 27 </style> 28 </body> 29 </html>