test-csp-violation-base-uri.html

Enable keyboard shortcuts

<html>

      <head>

          <title>CSP Base-URI Violation Test </title>

          <base href="https://evil.com/">

      </head>

      <body>

          <h1> Crashing the Base Element</h1>

      </body>

      <script>

        "use strict";

        window.violate = ()=>{

          document.head.innerHTML = "";

          const b = document.createElement("base");

          b.href = "https://evil.com";

          document.head.append(b);

};

      </script>

    </html>