firefox/dom/security/test/csp/file_sandbox_fail.js

function ok(result, desc) {
  window.parent.postMessage({ ok: result, desc }, "*");
}
ok(
  false,
  "documents sandboxed with allow-scripts should NOT be able to run <script src=...>"
);