iframe_inline.sub.html (576B)
1 <!-- Same as iframe.sub.html, but the script is inserted from an inline script. --> 2 <!DOCTYPE html> 3 <html> 4 <body> 5 <script nonce='forinlinescript'> 6 window.addEventListener('securitypolicyviolation', function() { 7 top.postMessage('CSP_VIOLATION', '*'); 8 }); 9 </script> 10 11 <!-- sha256 of the script below is 'F8UqObF6TSi2W4dDcDzAOAplJkYovBE6JpJjsZJy5HA=' --> 12 <script> 13 var s = document.createElement('script'); 14 s.type = 'text/javascript'; 15 s.src = "externalScript.js"; 16 document.getElementsByTagName('head')[0].appendChild(s); 17 </script> 18 </body> 19 </html>