blob: 2952a06aaf672307f12c3e4ea702259695d6aa01 [file] [log] [blame]
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
<iframe src="about:blank"></iframe>
Eval should be blocked in the iframe, but inline script should be allowed.
<script>
window.onload = function() {
frames[0].document.write("<script>alert(/PASS/); eval('alert(/FAIL/);');<\/script>");
}
</script>