object-src-url-allowed.html (688B)
1 <!DOCTYPE html> 2 <html> 3 4 <head> 5 <script src="/resources/testharness.js"></script> 6 <script src="/resources/testharnessreport.js"></script> 7 <!-- 8 Content-Security-Policy: 9 object-src 'self'; 10 script-src 'self' 'unsafe-inline'; 11 report-uri /reporting/resources/report.py?op=put&reportID={{$id}} 12 --> 13 </head> 14 15 <body> 16 <object type="image/png" data="/content-security-policy/support/pass.png"></object> 17 <!-- 18 We rely on the report because we can't rely on the onload event for 19 "allowed" tests as it is not fired for object and embed 20 --> 21 <script src='../support/checkReport.sub.js?reportExists=false'></script> 22 </body> 23 24 </html>