-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.html
72 lines (69 loc) · 2.21 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>🔥 CSP reporting</title>
</head>
<style>
body {
/* font-family: system-ui, sans-serif; */
/* Ext-like */
font-size: 12px;
font-family: tahoma, arial, verdana, sans-serif;
}
html,body {
padding: 0;
margin: 0;
}
main {
margin: 1em;
}
</style>
<!-- ExtJS (allowed by: style-src https://*.lib.mol.pl) -->
<link rel="stylesheet" type="text/css" href="https://extjs.lib.mol.pl/ext-6.5.3/build/classic/theme-classic/resources/theme-classic-all.css">
<!-- ExtJS (allowed by: script-src-elem https://*.lib.mol.pl) -->
<script type="text/javascript" src="https://extjs.lib.mol.pl/ext-6.5.3/build/ext-all.js"></script>
<script type="text/javascript" src="https://extjs.lib.mol.pl/ext-6.5.3/build/classic/theme-classic/theme-classic.js"></script>
<body>
<main>
<h2>Scripts</h2>
<div style="display: grid; grid-template-columns: repeat(2, max-content); gap: 1em 2em">
<d>
<p>Blocked by script-src-attr 'none'</p>
<button onclick="alert('works?')">onclick test</button>
</d>
<d>
<p>Allowed by script-src-elem 'unsafe-inline'</p>
<button id="script-tag">script tag</button>
<script>
document.querySelector('#script-tag').addEventListener('click', () => {
alert('Hello from script tag');
})
</script>
</d>
<d>
<p>Allowed by script-src-elem 'self'</p>
<button id="script-src">script src="local"</button>
<script src="assets/local.js"></script>
</d>
<d>
<p>Allowed by script-src-elem 'self'</p>
<button id="script-module">script module</button>
<script type="module" src="assets/module-main.js"></script>
</d>
</div>
<p>Note! Tests will work differently on file:/ and
on <a href="http://localhost/_test/CSP-policy/test.html">localhost</a>.</p>
<h2>ExtJS Grid</h2>
<div id="ext-grid"></div>
<script src="assets/ext-grid.js"></script>
<h2>PDF frame</h2>
<p>Guard: `frame-src 'self'` (or child-src or default-src)</p>
<iframe class="pdf-component"
style="height: 400px; width: 900px; border: 1px solid darkgreen; margin: 0px;"
src="./assets/report.pdf"
></iframe>
</main>
</body>
</html>