18 lines
476 B
HTML
18 lines
476 B
HTML
<html>
|
|
<head>
|
|
<title>CSP Base-URI Violation Test </title>
|
|
<base href="https://evil.com/">
|
|
</head>
|
|
<body>
|
|
<h1> Crashing the Base Element</h1>
|
|
</body>
|
|
<script>
|
|
"use strict";
|
|
window.violate = ()=>{
|
|
document.head.innerHTML = "";
|
|
const b = document.createElement("base");
|
|
b.href = "https://evil.com";
|
|
document.head.append(b);
|
|
};
|
|
</script>
|
|
</html>
|