Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /html/semantics/forms/the-select-element/customizable-select/selectedcontent-parser-script-csp-strict-dynamic.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc' 'strict-dynamic'">
<title>Parser-inserted scripts in a selected option don't bypass 'strict-dynamic'</title>
<script nonce="abc" src="/resources/testharness.js"></script>
<script nonce="abc" src="/resources/testharnessreport.js"></script>
<script nonce="abc">
window.runs = 0;
</script>
<select>
<button><selectedcontent></selectedcontent></button>
<option>one</option>
<option selected>
<script src="data:text/javascript,runs++"></script>
<div>
<template shadowrootmode="open" shadowrootclonable>
<script src="data:text/javascript,runs++"></script>
</template>
</div>
</option>
</select>
<script nonce="abc">
promise_test(async () => {
await new Promise(resolve => window.addEventListener("load", resolve));
await new Promise(resolve => step_timeout(resolve, 0));
assert_equals(runs, 0, "Nonce-less scripts shouldn't run");
}, "Cloning a selected option into selectedcontent doesn't run parser-inserted scripts blocked by 'strict-dynamic'");
</script>