blob: df4a4438935a5798d3672111081984d6ef9d0ef1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
</head>
<body>
<script>
const blob_payload = `
<!doctype html>
<script>
var i = false;
try {
eval('i = true');
} catch {}
opener.postMessage(i ? "eval allowed" : "eval blocked", '*');
</scr` + `ipt>
`;
var blob_url = URL.createObjectURL(
new Blob([blob_payload], { type: 'text/html' }));
parent.location = blob_url;
</script>
</body>
</html>
|
