third_party/web_platform_tests/content-security-policy/blink-contrib/srcdoc-doesnt-bypass-script-src.sub.html - cobalt - Git at Google

 <!DOCTYPE html>
 <html>

 <head>
     <!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
     <title>srcdoc-doesnt-bypass-script-src</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
     <script src="../support/alertAssert.sub.js?alerts=%5B%5D"></script>
     <!-- enforcing policy:
 script-src 'self'; connect-src 'self';
 -->
 </head>

 <body>
     This test passes if it doesn&apos;t alert fail.
     <iframe srcdoc="&lt;script&gt;window.parent.alert_assert(&apos;FAIL&apos;)&lt;/script&gt;"></iframe>
     <div id="log"></div>
     <script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=script-src%20&apos;self&apos;"></script>
 </body>

 </html>
	<!DOCTYPE html>
	<html>

	<head>
	<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
	<title>srcdoc-doesnt-bypass-script-src</title>
	<script src="/resources/testharness.js"></script>
	<script src="/resources/testharnessreport.js"></script>
	<script src="../support/alertAssert.sub.js?alerts=%5B%5D"></script>
	<!-- enforcing policy:
	script-src 'self'; connect-src 'self';
	-->
	</head>

	<body>
	This test passes if it doesn't alert fail.
	<iframe srcdoc="<script>window.parent.alert_assert('FAIL')</script>"></iframe>
	<div id="log"></div>
	<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=script-src%20'self'"></script>
	</body>

	</html>