<!DOCTYPE html>
<html>
<head>
    <meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; report-uri resources/save-report.php">
</head>
<body>
    <script>
        try {
            eval("alert('FAIL')");
        } catch (e) {
            console.log(e);
            console.log('PASS: eval() blocked.');
        }
    </script>
    <script src="resources/go-to-echo-report.js"></script>
</body>
</html>