tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

script-src-1_2.html (746B)

      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4    <title>Inline script should not run without 'unsafe-inline' script-src directive.</title>
      5    <meta http-equiv="Content-Security-Policy" content="script-src *;">
      6    <script src='/resources/testharness.js'></script>
      7    <script src='/resources/testharnessreport.js'></script>
      8    <script src='inlineTests.js'></script>
      9 </head>
     10 <body>
     11    <h1>Inline script should not run without 'unsafe-inline' script-src directive, even for script-src *.</h1>
     12    <div id='log'></div>
     13 
     14    <script>
     15      t1.step(function() {assert_unreached('Unsafe inline script ran.');});
     16    </script>
     17 
     18    <img src='doesnotexist.jpg' onerror='t2.step(function() { assert_unreached("Unsafe inline event handler ran.") });'>
     19 </body>
     20 </html>