to-javascript-parent-initiated-parent-csp.html

Enable keyboard shortcuts

This test has a WPT meta file that expects 1 subtest issues.
This WPT test may be referenced by the following Test IDs:
- /content-security-policy/navigation/to-javascript-parent-initiated-parent-csp.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<head>

<meta http-equiv="content-security-policy" content="script-src 'self' 'nonce-abc'">

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

</head>

<body>

<iframe src="support/frame-with-csp.sub.html"></iframe>

<div onclick="frames[0].location.href = 'javascript:parent.postMessage(\'executed\', \'*\')'" id="special_div"></div>

<script nonce='abc'>

  var t = async_test("Should not have executed the javascript url");

  frames[0].addEventListener('load', () => {

    window.onmessage = t.step_func(function(e) {

      if (e.data == "executed")

        assert_true(false, "Javascript url executed");

});

    window.addEventListener('securitypolicyviolation', t.step_func_done(function(e) {

      assert_equals(e.blockedURI, 'inline');

      assert_equals(e.violatedDirective, 'script-src-attr');

    }));

    document.getElementById('special_div').click();

});

</script>

</body>