Import Cobalt 19.master.0.203780
Includes the following patches:
https://cobalt-review.googlesource.com/c/cobalt/+/5210
by errong.leng@samsung.com
https://cobalt-review.googlesource.com/c/cobalt/+/5270
by linus.wang@samsung.com
diff --git a/src/third_party/web_platform_tests/content-security-policy/blink-contrib/script-src-overrides-default-src.sub.html b/src/third_party/web_platform_tests/content-security-policy/blink-contrib/script-src-overrides-default-src.sub.html
new file mode 100644
index 0000000..adcc90a
--- /dev/null
+++ b/src/third_party/web_platform_tests/content-security-policy/blink-contrib/script-src-overrides-default-src.sub.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<!--
+ | This test was modified to not use the HTML4 intrinsic event 'body onload='.
+ -->
+<html>
+
+<head>
+ <!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
+ <title>script-src-overrides-default-src</title>
+ <script src="/resources/testharness.js"></script>
+ <script src="/resources/testharnessreport.js"></script>
+ <script src="../support/logTest.sub.js?logs=[]"></script>
+ <script src='../support/alertAssert.sub.js?alerts=["PASS 1 of 2","PASS 2 of 2"]'></script>
+ <!-- enforcing policy:
+default-src about:; script-src 'self' 'unsafe-inline' 'self' 'unsafe-inline'; connect-src 'self';
+-->
+</head>
+
+<body>
+ <script>
+ alert_assert('PASS 1 of 2');
+ document.body.onload=function() { alert_assert('PASS 2 of 2'); }
+ </script>
+ <div id="log"></div>
+ <script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
+</body>
+
+</html>
