| <!DOCTYPE html> |
| <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'"> |
| <script src="/resources/testharness.js" nonce="abc"></script> |
| <script src="/resources/testharnessreport.js" nonce="abc"></script> |
| |
| <!-- Parser-inserted script --> |
| <script nonce="abc"> |
| internals.registerURLSchemeAsBypassingContentSecurityPolicy('http'); |
| </script> |
| <script id="test1" src="http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script-set-attribute.js?t1"></script> |
| <script nonce="abc"> |
| test(t => { |
| assert_equals(document.querySelector("#test1").getAttribute("loaded"), null); |
| }, "Parser-inserted scripts do not bypass."); |
| </script> |
| |
| <!-- Non-parser-inserted script --> |
| <script nonce="abc"> |
| internals.registerURLSchemeAsBypassingContentSecurityPolicy('http'); |
| async_test(t => { |
| var s = document.createElement("script"); |
| s.id = "test2"; |
| s.src = "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script-set-attribute.js?t2"; |
| s.onerror = t.unreached_func("The script should execute."); |
| s.onload = t.step_func_done(_ => { |
| assert_equals(s.getAttribute("loaded"), "true"); |
| }); |
| document.head.appendChild(s); |
| }, "Parser-inserted scripts do not bypass."); |
| </script> |
| |
| <!-- Cleanup --> |
| <script nonce="abc"> |
| add_completion_callback(_ => { |
| internals.removeURLSchemeRegisteredAsBypassingContentSecurityPolicy('http'); |
| }); |
| </script> |
