Source code
Revision control
Copy as Markdown
Other Tools
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
</head>
<body>
<script>
const blob_payload = `
<!doctype html>
<script>
var i = false;
try {
eval('i = true');
} catch {}
opener.postMessage(i ? "eval allowed" : "eval blocked", '*');
</scr` + `ipt>
`;
var blob_url = URL.createObjectURL(
new Blob([blob_payload], { type: 'text/html' }));
parent.location = blob_url;
</script>
</body>
</html>