| <!DOCTYPE html> |
| <html> |
| <head> |
| <title>script-src disallowed wildcard use</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| </head> |
| <body> |
| <!-- enforcing policy: |
| script-src 'nonce-nonce' *; connect-src 'self'; |
| --> |
| <script nonce="nonce"> |
| var t1 = async_test('data: URIs should not match *'); |
| t1.step(function() { |
| var script = document.createElement("script"); |
| script.src = 'data:application/javascript,'; |
| script.addEventListener('load', t1.step_func(function() { |
| assert_unreached('Should not successfully load data URI.'); |
| })); |
| script.addEventListener('error', t1.step_func(function() { |
| t1.done(); |
| })); |
| document.head.appendChild(script); |
| }); |
| </script> |
| </body> |
| </html> |
