script-multiple-allowed.php | Explore in Territory

<?php
    header("Content-Security-Policy: script-src 'unsafe-inline' 'self'");
    header("Content-Security-Policy-Report-Only: script-src 'self' 'nonce-abc'");
?>
<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script nonce="abc">
    async_test(t => {
        var watcher = new EventWatcher(t, document, ['securitypolicyviolation','securitypolicyviolation']);
        watcher
            .wait_for('securitypolicyviolation')
            .then(t.step_func(e => {
                assert_equals(e.blockedURI, "inline");
                assert_equals(e.lineNumber, 29);
                return watcher.wait_for('securitypolicyviolation');
            }))
            .then(t.step_func_done(e => {
                assert_equals(e.blockedURI, "inline");
                assert_equals(e.lineNumber, 32);
            }));
    }, "Unnonced script blocks generate reports.");

    var testList = [
        async_test("Script without nonce executes"),
        async_test("Script with incorrect nonce executes")
    ];
    var executed = [
        false,
        false
    ];
</script>
<script>
    executed[0] = true;
</script>
<script nonce="xyz">
    executed[1] = true;
</script>
<script nonce="abc">
    testList[0].step(_ => {
        assert_true(executed[0]);
        testList[0].done();
    });

    testList[1].step(_ => {
        assert_true(executed[1]);
        testList[1].done();
    });
</script>
chromium/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/nonces/script-multiple-allowed.php
