| <!DOCTYPE html> |
| <html> |
| |
| <head> |
| <title>eval-in-iframe</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| </head> |
| |
| <body> |
| <p>This test checks that iframes correctly block the eval function.</p> |
| <script> |
| var tests = [ |
| { "name": "script-src blocks eval unless 'unsafe-eval' is specified.", |
| "csp": "script-src 'unsafe-inline'" }, |
| { "name": "default-src blocks eval unless 'unsafe-eval' is specified.", |
| "csp": "default-src 'unsafe-inline'" }, |
| ]; |
| |
| tests.forEach(test => { |
| async_test(t => { |
| var child = document.createElement('iframe'); |
| child.src = '/content-security-policy/unsafe-eval/support/echo-eval-with-policy.py?policy=' + encodeURIComponent(test.csp); |
| window.addEventListener('message', t.step_func(e => { |
| if (e.source != child.contentWindow) |
| return; |
| if (e.data === "eval blocked") { |
| t.done(); |
| } |
| else if (e.data === "eval allowed") { |
| assert_unreached("Eval code was executed in iframe"); |
| } |
| })); |
| document.body.appendChild(child); |
| }, test.name); |
| }); |
| </script> |
| </body> |
| |
| </html> |
