object-in-svg-foreignobject.sub.html (930B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <title>Object inside SVG foreignobject respect csp</title> 5 <meta http-equiv="Content-Security-Policy" content="object-src 'none'"> 6 <script src="/resources/testharness.js"></script> 7 <script src="/resources/testharnessreport.js"></script> 8 <script> 9 async_test(function(t) { 10 document.addEventListener("securitypolicyviolation", t.step_func(function(e) { 11 if (e.blockedURI != "{{location[scheme]}}://{{location[host]}}/content-security-policy/support/media/flash.swf") 12 return; 13 14 assert_equals(e.violatedDirective, "object-src"); 15 t.done(); 16 })); 17 }, "Should throw a securitypolicyviolation"); 18 </script> 19 </head> 20 <body> 21 <svg> 22 <foreignObject> 23 <embed type="application/x-shockwave-flash" src="/content-security-policy/support/media/flash.swf"> 24 </foreignObject> 25 </svg> 26 </body> 27 </html>