content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html - external/w3c/web-platform-tests - Git at Google

 <!DOCTYPE html>
 <html>

 <head>
     <!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
     <title>scriptnonce-basic-blocked</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
     <script src='../support/alertAssert.sub.js?alerts=["PASS (closely-quoted nonce)","PASS (nonce w/whitespace)"]'></script>
     <!-- enforcing policy:
 script-src 'self' 'unsafe-inline' 'nonce-noncynonce'; connect-src 'self';
 -->
     <script nonce="noncynonce">
         alert_assert('PASS (closely-quoted nonce)');

     </script>
     <script nonce="   noncynonce    ">
         alert_assert('PASS (nonce w/whitespace)');

     </script>
     <script nonce="noncynonce noncynonce">
         alert_assert('FAIL (1/3)');

     </script>
     <script>
         alert_assert('FAIL (2/3)');

     </script>
     <script nonce="noncynonceno?">
         alert_assert('FAIL (3/3)');

     </script>
 </head>

 <body>
     <p>
         This tests the effect of a valid script-nonce value. It passes if a CSP violation is generated, and the two PASS alerts are executed.
     </p>
     <div id="log"></div>
     <script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=script-src%20&apos;nonce-noncynonce&apos;"></script>
 </body>

 </html>
	<!DOCTYPE html>
	<html>

	<head>
	<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
	<title>scriptnonce-basic-blocked</title>
	<script src="/resources/testharness.js"></script>
	<script src="/resources/testharnessreport.js"></script>
	<script src='../support/alertAssert.sub.js?alerts=["PASS (closely-quoted nonce)","PASS (nonce w/whitespace)"]'></script>
	<!-- enforcing policy:
	script-src 'self' 'unsafe-inline' 'nonce-noncynonce'; connect-src 'self';
	-->
	<script nonce="noncynonce">
	alert_assert('PASS (closely-quoted nonce)');

	</script>
	<script nonce=" noncynonce ">
	alert_assert('PASS (nonce w/whitespace)');

	</script>
	<script nonce="noncynonce noncynonce">
	alert_assert('FAIL (1/3)');

	</script>
	<script>
	alert_assert('FAIL (2/3)');

	</script>
	<script nonce="noncynonceno?">
	alert_assert('FAIL (3/3)');

	</script>
	</head>

	<body>
	<p>
	This tests the effect of a valid script-nonce value. It passes if a CSP violation is generated, and the two PASS alerts are executed.
	</p>
	<div id="log"></div>
	<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=script-src%20'nonce-noncynonce'"></script>
	</body>

	</html>