chromium/src/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/function-constructor-allowed.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 </script>
 </head>
 <body>
 <script>
 (new Function("alert('PASS')"))();
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	</head>
	<body>
	<script>
	(new Function("alert('PASS')"))();
	</script>
	</body>
	</html>