2012-08-30 10:58:24 -07:00
|
|
|
<!--
|
|
|
|
|
-- The original CSP implementation predates the CSP 1.0 spec and didn't
|
|
|
|
|
-- block inline styles, so when the prefixed X-Content-Security-Policy header is used,
|
|
|
|
|
-- as it is for this file, inline styles should be allowed.
|
|
|
|
|
-->
|
2010-02-23 14:28:18 -08:00
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>CSP inline script tests</title>
|
|
|
|
|
</head>
|
2013-01-09 10:57:05 -08:00
|
|
|
<body onload="window.parent.scriptRan(false, 'eventattr', 'event attribute in body tag fired')">
|
2010-02-23 14:28:18 -08:00
|
|
|
|
|
|
|
|
<script type="text/javascript">
|
2013-01-09 10:57:05 -08:00
|
|
|
window.parent.scriptRan(false, "textnode", "text node in a script tag executed.");
|
2010-02-23 14:28:18 -08:00
|
|
|
</script>
|
|
|
|
|
|
2013-01-09 10:57:05 -08:00
|
|
|
<iframe src='javascript:window.parent.parent.scriptRan(false, "jsuri", "javascript: uri in image tag")'></iframe>
|
2010-02-23 14:28:18 -08:00
|
|
|
|
2013-01-09 10:57:05 -08:00
|
|
|
<a id='anchortoclick' href='javascript:window.parent.scriptRan(false, "jsuri", "javascript: uri in anchor tag ran when clicked.");'>stuff</a>
|
2010-02-23 14:28:18 -08:00
|
|
|
</body>
|
|
|
|
|
</html>
|
