<!DOCTYPE html>
<head>
  <meta http-equiv="Content-Security-Policy" content="img-src 'none'">
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>

</head>
<body>
  <script>
    var t0 = async_test("Image loaded in srcdoc iframe using document.write is blocked");
    var t1 = async_test("Image loaded in normal iframe using document.write is blocked");
    var t2 = async_test("Image loaded directly in simple srcdoc iframe is blocked");

    window.onmessage = function(e) {
      var current_test;
      if (e.data.type == "spv0") {
        current_test = t0;
      } else if (e.data.type == "spv1") {
        current_test = t1;
      } else if (e.data.type == "spv2") {
        current_test = t2;
      } else {
        t0.step(function() {assert_true(false, "Unexpected message received from child frames")});
        t1.step(function() {assert_true(false, "Unexpected message received from child frames")});
        t2.step(function() {assert_true(false, "Unexpected message received from child frames")});
      }

      current_test.step(function() {
        assert_equals(e.data.violatedDirective, 'img-src');
        current_test.done();
      });
    }
  </script>

  <!--As discovered thanks to crbug.com/920531, there is a bug in CSP where the
      CSP is not inherited when using document.open/document.write to edit a
      document's contents. -->
  <iframe id="frame1" srcdoc=""></iframe>

  <!-- This is speculatively correct https://github.com/whatwg/html/issues/4510 -->
  <iframe id="frame2" src="/content-security-policy/common/blank.html"></iframe>

  <!--<script>
        window.addEventListener('securitypolicyviolation', function(e) {
          window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');
        });
      </script>
      <img src='/content-security-policy/support/fail.png'>
  -->
  <iframe srcdoc="<script>window.addEventListener('securitypolicyviolation', function(e) {window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');});</script><img src='/content-security-policy/support/fail.png'>"></iframe>
  <script>
    var frames = ['frame1', 'frame2'];
    for (var i = 0; i < frames.length; i++) {
      var body_text = ['<script>',
                       ' window.addEventListener("securitypolicyviolation", function(e) {',
                       '  window.top.postMessage({type: "spv'+ i + '", violatedDirective: e.violatedDirective}, "*");',
                       ' });',
                       '</scr' + 'ipt>',
                       '<img src="/content-security-policy/support/fail.png">'].join('\n');

      var e = document.getElementById(frames[i]);
      var n = e.contentWindow.document;
      n.open();
      n.write("<html><body>" + body_text + "</body></html>");
      n.close();
    }
  </script>
</body>
</html>