<!DOCTYPE html>

<head>
  <title>Cobalt eval() allowed when missing csp test</title>
  <script src='black_box_js_test_utils.js'></script>
</head>

<body>
  <h1>
    <span id="unique_id">ID element</span>
  </h1>
  <script>
    // When Content Security Policy is missing, JavaScript eval() should be
    // allowed.
    assertEqual(4, eval('1+3'));
    onEndTest();
  </script>
</body>