third_party/web_platform_tests/content-security-policy/generic/generic-0_1-img-src.html

<!--
    This file is modified for Cobalt. The event handlers are set in script
    instead of in tag attribute.
-->
<!DOCTYPE HTML>
<html>
<head>
    <title>default-src should cascade to img-src directive</title>
    <script src='/resources/testharness.js'></script>
    <script src='/resources/testharnessreport.js'></script>
    <script src='../support/siblingPath.js'></script>
</head>
<body>
    <h1>default-src should cascade to img-src directive</h1>
    <div id='log'></div>

    <script>
      var imgsrc = async_test("Verify cascading of default-src to img-src policy");
      var onerrorFired = false;
    </script>

    <img id='imgfail' src=''>
    <img id='imgpass' src='../support/pass.png'>

    <script>
      document.getElementById('imgfail').onload = function() {
        imgsrc.step(function() { assert_unreached("Image load was not blocked."); });
      }
      document.getElementById('imgfail').onerror = function() {
        onerrorFired = true;
      }
      document.getElementById('imgpass').onload = function() {
        imgsrc.step(function() { assert_true(true, "Image load was blocked."); });
      }
      document.getElementById('imgfail').src = buildSiblingPath('www1', '../support/fail.png');
      onload = function() {
        imgsrc.step(function() { assert_true(onerrorFired, "onerror handler for blocked img didn't fire");});
        imgsrc.done();
      }
    </script>

    <script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=default-src%20%27self%27%20%27unsafe-inline%27'></script>

</body>
</html>