Source code
Revision control
Copy as Markdown
Other Tools
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'">
</head>
<body>
<script>
window.__scriptLoaded = false;
window.__crossOriginScriptLoaded = false;
</script>
<script src="iframe-self-pass.js"></script>
<script src="http://{{hosts[alt][]}}:{{ports[http][0]}}/content-security-policy/sandbox/support/iframe-cross-pass.js"></script>
<script>
var sameOriginMsg = window.__scriptLoaded
? "PASS same-origin script allowed in sandboxed iframe"
: "FAIL same-origin script blocked in sandboxed iframe";
var crossOriginMsg = window.__crossOriginScriptLoaded
? "FAIL cross-origin script not blocked in sandboxed iframe"
: "PASS cross-origin script blocked in sandboxed iframe";
window.parent.postMessage(sameOriginMsg, "*");
window.parent.postMessage(crossOriginMsg, "*");
</script>
</body>
</html>