blob: 71cf7641945363698d7e30dbbeb5eea5eef5fffe [file] [log] [blame]
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
<iframe src="about:blank"></iframe>
Eval should be blocked in the iframe, but inline script should be allowed.
<script>
window.onload = function() {
frames[0].document.write("<script>alert(/PASS/); eval('alert(/FAIL/);');<\/script>");
frames[0].document.close();
}
</script>