<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-test'">
<script nonce="test">
if (window.testRunner)
    testRunner.dumpAsText();

// Include a script not included in the script-src to cause a violation.
// Include another script to report the document URI of this report, expecting
// it to be stripped to only consist of the URL protocol.
var violatingScript = "<script>\n\<" + "/script>"
var reportingScript = "<script nonce=\"test\"> testRunner.waitUntilDone(); document.addEventListener('securitypolicyviolation', e => { document.body.innerHTML += `documentURI = <b>${e.documentURI}</b><br/><br/>`; testRunner.notifyDone(); });<" + "/script>";
    
let blob = new Blob([violatingScript + reportingScript], {type : "text/html"});
if (window.testRunner)
    testRunner.queueLoad(URL.createObjectURL(blob));
</script>
<body>
<p>Initial page</p>
</body>
</head>
</html>