script-multiple-blocked.php | Explore in Territory

<?php
    header("Content-Security-Policy: script-src 'self' 'nonce-abc'");
    header("Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'self'");
?>
<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script nonce="abc">
    async_test(t => {
        var watcher = new EventWatcher(t, document, ['securitypolicyviolation','securitypolicyviolation']);
        watcher
            .wait_for('securitypolicyviolation')
            .then(t.step_func(e => {
                assert_equals(e.blockedURI, "inline");
                assert_equals(e.lineNumber, 23);
                return watcher.wait_for('securitypolicyviolation');
            }))
            .then(t.step_func_done(e => {
                assert_equals(e.blockedURI, "inline");
                assert_equals(e.lineNumber, 26);
            }));
    }, "Unnonced script blocks generate reports.");

    var executed_test = async_test("Nonced script executes, and does not generate a violation report.");
    var unexecuted_test = async_test("Blocks without correct nonce do not execute, and generate violation reports");
</script>
<script>
    unexecuted_test.assert_unreached("This code block should not execute.");
</script>
<script nonce="xyz">
    unexecuted_test.assert_unreached("This code block should not execute.");
</script>
<script nonce="abc">
    executed_test.done();
    unexecuted_test.done();
</script>

chromium/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/nonces/script-multiple-blocked.php