src/third_party/web_platform_tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html - cobalt - Git at Google

 <!DOCTYPE html>
 <html>

 <head>
     <!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
     <title>blob-urls-do-not-match-self</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
     <script src="../support/logTest.sub.js?logs=[]"></script>
     <script src="../support/alertAssert.sub.js?alerts=[]"></script>
     <!-- enforcing policy:
 script-src 'self' 'unsafe-inline'; connect-src 'self'; child-src 'self';
 -->
 </head>

 <body>
     <p>
         blob: URLs are same-origin with the page in which they were created, but explicitly do not match the &apos;self&apos; or '*' source in CSP directives because they are more akin to 'unsafe-inline' content.
     </p>
     <script>
         function fail() {
             alert_assert("FAIL!");
         }
         var b = new Blob(['fail();'], {
             type: 'application/javascript'
         });
         var script = document.createElement('script');
         script.src = URL.createObjectURL(b);
         document.body.appendChild(script);

     </script>
     <div id="log"></div>
     <script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=script-src%20&apos;self&apos;%20&apos;unsafe-inline&apos;%20&apos;&apos;"></script>
 </body>

 </html>
	<!DOCTYPE html>
	<html>

	<head>
	<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
	<title>blob-urls-do-not-match-self</title>
	<script src="/resources/testharness.js"></script>
	<script src="/resources/testharnessreport.js"></script>
	<script src="../support/logTest.sub.js?logs=[]"></script>
	<script src="../support/alertAssert.sub.js?alerts=[]"></script>
	<!-- enforcing policy:
	script-src 'self' 'unsafe-inline'; connect-src 'self'; child-src 'self';
	-->
	</head>

	<body>
	<p>
	blob: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content.
	</p>
	<script>
	function fail() {
	alert_assert("FAIL!");
	}
	var b = new Blob(['fail();'], {
	type: 'application/javascript'
	});
	var script = document.createElement('script');
	script.src = URL.createObjectURL(b);
	document.body.appendChild(script);

	</script>
	<div id="log"></div>
	<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=script-src%20'self'%20'unsafe-inline'%20''"></script>
	</body>

	</html>