<!DOCTYPE html><!-- webkit-test-runner [ contentSecurityPolicyExtensionMode=v2 ] -->
<html>
<head>
    <meta http-equiv="Content-Security-Policy" content="script-src 'self' https: 'nonce-test';">
    <p><br>Test that scheme-only CSP for extensions blocks sources with that scheme.</p>
</head>
<body>
    <div id="result" text="FAIL">
      PASS
    </div>
    <script nonce='test'>
        if (window.testRunner) {
            testRunner.waitUntilDone();
            testRunner.dumpAsText();
        }

        let script = document.createElement('script');
        script.src = "https://localhost:8443/security/contentSecurityPolicy/resources/script.js";

        script.onload = function() {
            alert("FAIL: Should not have loaded script.");
            testRunner.notifyDone();
        };

        script.onerror = function() {
            alert("PASS: Successfully blocked script.");
            testRunner.notifyDone();
        };

        document.body.append(script);
    </script>
</body>
</html>