blob: e7bf79c0fdc2e3a6d2dec2f74f6dff74cef0c0a2 [file] [log] [blame]
A separate Report-Only policy does not influence `strict-dynamic` in the script-src directive.
PASS Script injected via `appendChild` is allowed with `strict-dynamic` + Report-Only `script-src 'none'` policy.