navigate-self-to-javascript.html (411B)
1 <meta http-equiv="Content-Security-Policy" content="img-src 'none'"/> 2 <script> 3 const js_payload = ` 4 <div> 5 <img src="${window.origin}/content-security-policy/support/fail.png" 6 onload="opener.postMessage(\\\'img loaded\\\', \\\'*\\\');" 7 onerror="opener.postMessage(\\\'img blocked\\\', \\\'*\\\');" 8 > 9 </div> 10 `; 11 open(`javascript:'${js_payload}'`,"_self"); 12 </script>