LayoutTests/security/contentSecurityPolicy/worker-inherits-blocks-eval.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }
 </script>
 </head>
 <body>
 <p>This tests that the Content Security Policy (CSP) of the owner document (this page) blocks a file-URL Web Worker from using <code>eval()</code> because the parent's CSP does not list <code>unsafe-eval</code> in script-src.</p>
 <pre id="result"></pre>
 <script>
 window.onmessage = function (event)
 {
     document.getElementById("result").textContent = event.data;
     if (window.testRunner)
         testRunner.notifyDone();
 }

 var worker;
 try {
     worker = new Worker("resources/worker-inherits-blocks-eval.js");
     worker.onmessage = function (event) { window.postMessage(event.data, "*") };
 } catch (exception) {
     window.postMessage("FAIL should not have thrown an exception when creating worker. Threw exception " + exception + ".", "*");
 }
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}
	</script>
	</head>
	<body>
	<p>This tests that the Content Security Policy (CSP) of the owner document (this page) blocks a file-URL Web Worker from using <code>eval()</code> because the parent's CSP does not list <code>unsafe-eval</code> in script-src.</p>
	<pre id="result"></pre>
	<script>
	window.onmessage = function (event)
	{
	document.getElementById("result").textContent = event.data;
	if (window.testRunner)
	testRunner.notifyDone();
	}

	var worker;
	try {
	worker = new Worker("resources/worker-inherits-blocks-eval.js");
	worker.onmessage = function (event) { window.postMessage(event.data, "*") };
	} catch (exception) {
	window.postMessage("FAIL should not have thrown an exception when creating worker. Threw exception " + exception + ".", "*");
	}
	</script>
	</body>
	</html>